SAP Business Planning and Consolidation and SAP Business Warehouse SQL Injection Vulnerability Allowing Data Manipulation

A vulnerability exists in SAP Business Planning and Consolidation and SAP Business Warehouse due to inadequate authorization checks. This flaw enables authenticated users to execute specially crafted SQL statements that can read, modify, and delete database information. The vulnerability significantly impacts the system's confidentiality, integrity, and availability.

Impact

Exploitation of this vulnerability allows for unauthorized execution of SQL commands, leading to potential unauthorized access to, modification of, or deletion of database information.

Remediation

Users are advised to consult the SAP Security Notes for guidance on applying necessary patches. SAP Security Notes can be accessed through the SAP for Me platform, specifically on SAP Security Patch Days, which occur on the second Tuesday of each month.