Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1801585-1)
SAP Support Packages
(SAPKB62074, SAPKB64032, SAPKB70029, SAPKB70114, SAPKB70214, SAPKB71017, SAPKB71112, SAPKB72008, SAPKB73010, SAPKB73107, SAPKB73108, SAPKB74002)
Описание
The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by an attacker. The manipulated SQL statement can then be used to retrieve data from the database.
Как исправить
Please apply the support package mentioned in this note, or the respective correction instruction.The correction ensures that there is a stricter check of database column names that may have been supplied by an attacker.------------------------------------------------------------------------|Manual Activity |------------------------------------------------------------------------|VALID FOR ||Software Component SAP_BASIS SAP Basis compo...|| Release 620 Until SAPKB62073 || Release 640 Until SAPKB64031 || Release 700 SAPKB70004 - SAPKB70028 || Release 710 Until SAPKB71016 || Release 711 SAPKB71101 - SAPKB71111 || Release 701 Until SAPKB70113 || Release 702 SAPKB70201 - SAPKB70213 || Release 730 SAPKB73001 - SAPKB73009 || Release 720 SAPKB72002 - SAPKB72007 || Release 731 SAPKB73101 - SAPKB73106 || Release 740 Until SAPKB74001 |------------------------------------------------------------------------The manual activity described here is optional. Without the manual correction, the system will just display the message number "SLDBV:080" and the invalid column name in the status line in the case that an invalid column name is encountered.The manual activity consists of creating a message text:
1. Call transaction SE91
2. In the field "Message class", enter SLDBV
3. In the field "Number", enter 080
4. Press "Change"
5. Enter the message text: Column name "&1" is invalid
6. Press "Save" (Ctrl+S)
1. Call transaction SE91
2. In the field "Message class", enter SLDBV
3. In the field "Number", enter 080
4. Press "Change"
5. Enter the message text: Column name "&1" is invalid
6. Press "Save" (Ctrl+S)
Ссылки
