SAP Business Connector Input Validation Vulnerability

Bugtraq ID:	16671
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 15 2006 12:00AM
Updated:	May 16 2006 09:24PM
Credit:	Leandro Meiners of CYBSEC S.A. Security Systems discovered this vulnerability.
Vulnerable:	SAP Business Connector Core Fix 7 SAP Business Connector 4.7 SAP Business Connector 4.6
Not Vulnerable:

SAP Business Connector Input Validation Vulnerability

SAP Business Connector is susceptible to an input-validation vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input.

This issue allows remote attackers to execute phishing-style attacks against targeted SAP Business Connector administrators.

SAP Business Connector Input Validation Vulnerability

Attackers may use a web client to exploit this issue.

The following URI example demonstrates this issue:

http://www.example.com/WmRoot/adapter-index.dsp?url=http://www.attacker.com/

SAP Business Connector Input Validation Vulnerability

Solution:
The vendor has reportedly released fixes addressing this issue. Users of affected packages should contact the vendor for further information on obtaining fixes.

SAP Business Connector Input Validation Vulnerability

References:

• Phishing Vector in SAP BC (Business Connector) (Cybsec)
  
• SAP Homepage (SAP)
  
• CYBSEC - Security Advisory: Phishing Vector in SAP BC (Business Connector) (Leandro Meiners )