SAP CRM and SAP S/4HANA SQL Injection Vulnerability Allowing Full Database Compromise

A vulnerability exists in SAP CRM and SAP S/4HANA's Scripting Editor, where an authenticated attacker can exploit a flaw in a generic function module call. This exploitation allows the execution of unauthorized critical functionalities, including arbitrary SQL statements. The consequence is a full database compromise, significantly impacting confidentiality, integrity, and availability.

Impact

Exploitation of this vulnerability could lead to a full database compromise, with severe consequences for confidentiality, integrity, and availability.

Remediation

Users are advised to consult the SAP Security Notes for guidance on addressing this vulnerability. SAP Security Notes can be accessed through the SAP for Me platform, where users can find the complete list of security updates and patches. It is recommended to implement these security corrections as a priority.