Description
Eval injection in ide/core/base/server/net.xsjs in the Developer Workbench in SAP HANA allows remote attackers to execute arbitrary XSJX code via unspecified vectors.
References
- 20141008 [Onapsis Security Advisory 2014-028] SAP HANA Web-based Development Workbench Code Injection mailing-list
- 70293 vdb-entry
- http://packetstormsecurity.com/files/128597/SAP-HANA-Web-based-Development-Workbench-Code-Injection.html
- sap-hana-directives-code-execution(96879) vdb-entry
- 20141008 [Onapsis Security Advisory 2014-028] SAP HANA Web-based Development Workbench Code Injection mailing-list
- http://scn.sap.com/docs/DOC-55451
- https://service.sap.com/sap/support/notes/2015446
- http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-028