PT-2021-14533 · Sap · Bw Database Interface

Alexander Meier + 1 · Published 2021-01-12 · Updated 2022-06-03 · CVE-2021-21465

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP BW Database Interface (affected versions not specified)

Description The issue allows an attacker with low privileges to execute crafted database queries, exposing the backend database. This is due to the database executing SQL commands without properly sanitizing untrusted data, leading to a SQL injection issue that can fully compromise the affected SAP system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-21465

Affected Products

Bw Database Interface

References · 7

• 🔥 http://seclists.org/fulldisclosure/2022/May/42 · Exploit
• 🔥 http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html · Exploit
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21465 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21465 · Vendor Advisory
• https://t.me/cvenotify/31083 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2986980 · Note