Critical issues in SAP’s CRM application – patched on Tuesday – open the door to corporate espionage, security researchers warn.
SAP resolved a total of 19 software flaws yesterday. Among the most critical bugs is an SQL injection in SAP CRM WebClient User Interface (SAP Security Note 2450979). The issue, identified by researchers at enterprise app security specialists ERPScan, allows a remote attacker to send a special request and steal sensitive customer data including customer datasets, pricing, sales, and prospective bids.
“We recommend that SAP Customers patch vulnerabilities affecting SAP CRM as soon as possible, because this application stores and processes the lifeblood of any business – customer data,” Alexander Polyakov, founder and CTO of ERPScan told El Reg.
ERPScan’s review of SAP’s August patch batch can be found here. The majority of patches released by SAP this month are rated medium. The most common vulnerability type is cross site scripting (XSS).
SAP’s summary is here. In response to queries from El Reg, SAP confirmed ERPScan’s discovery without commenting on its potential seriousness. A spokesperson said:
For Full Story, Please click here.