Description
The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to spoof log entries via a crafted request, aka SAP Security Note 2109818.
References
- 20150527 [Onapsis Security Advisory 2015-007] SAP HANA Log Injection Vulnerability mailing-list
- http://www.onapsis.com/research/security-advisories/SAP-HANA-Log-Injection-Vulnerability-in-Extended-Application-Services
- 74859 vdb-entry
- http://packetstormsecurity.com/files/132067/SAP-HANA-Log-Injection.html
- 20150527 [Onapsis Security Advisory 2015-007] SAP HANA Log Injection Vulnerability mailing-list