SAP security note 2462813, “SQL Injection Vulnerability in Revenue Accounting”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Revenue Accounting allows an attacker to execute crafted database queries, exposing the backend database.
Some well-known impacts of SQL Injection vulnerability are:
- Read sensitive data, modify or delete data from the database
- Execute admin-level operations on the database
Solution
Use the standard function FREE_SELECTIONS_RANGE_2_WHERE to convert the format from RSDS_TRANGE to RSDS_TWHERE at the closest place. This ensures that every dynamic selection condition is formatted by the standard function before the SQL query sentence.
This document is causing the following side effect: 2486248 – Correct Datasource 0FARR_RECKEY_ATTR Logic.
Reason and prerequisites
If customers reuse these DB access classes for their custom development, it may lead to SQL Injection errors or sensitive data access.
Affected components
- REVREC 130: from 130 to SAPK-13001INREVREC
- REVREC 120: from 120 to SAPK-12003INREVREC
Full note on SAP: SAP Support Launchpad note 2462813
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
