PT-2017-8946 · Sap · Sap Business One For Android

Ravindra Singh Rathore · Published 2017-05-25 · Updated 2019-07-08 · CVE-2016-6256

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Business One for Android version 1.2.3

Description The issue allows remote attackers to conduct XML External Entity (XXE) attacks. This is achieved by sending crafted XML data in a request to the "B1iXcellerator/exec/soap/vP.001sap0003.in WCSX/com.sap.b1i.vplatform.runtime/INB WS CALL SYNC XPT/INB WS CALL SYNC XPT.ipo/proc" API endpoint.

Recommendations For SAP Business One for Android version 1.2.3, consider restricting access to the vulnerable API endpoint "B1iXcellerator/exec/soap/vP.001sap0003.in WCSX/com.sap.b1i.vplatform.runtime/INB WS CALL SYNC XPT/INB WS CALL SYNC XPT.ipo/proc" until a patch is available.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2016-6256

Affected Products

Sap Business One For Android

References · 5

• 🔥 https://exploit-db.com/exploits/42036 · Exploit
• 🔥 http://packetstormsecurity.com/files/142597/SAP-Business-One-For-Android-1.2.3-XML-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-6256 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6256 · Vendor Advisory
• http://securityfocus.com/bid/98590 · Note