Description (CNA)
SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows an authenticated attacker to inject arbitrary SQL code through user-controlled input fields. The application concatenates these inputs directly into SQL queries without proper validation or escaping. As a result, an attacker can manipulate the WHERE clause logic and potentially gain unauthorized access to or modify database information. This vulnerability has no impact on integrity and low impact on the confidentiality and availability of the application.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SAP_SE / SAP NetWeaver (Feedback Notification) | affected SAP_ABA 700; affected 701; affected 702; affected 731; affected 740; affected 750; affected 751; affected 752; affected 75A; affected 75B; affected 75C; affected 75D; affected 75E; affected 75F; affected 75G; affected 75H; affected 75I; affected 816 |
CWE
CWE-89
References
ADP enrichment
No English description supplied.
No references supplied.