Description
SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to read arbitrary files via an IMPORT FROM SQL statement, aka SAP Security Note 2109565.
References
- 20150527 [Onapsis Security Advisory 2015-006] SAP HANA Information Disclosure via SQL IMPORT FROM statement mailing-list
- 74861 vdb-entry
- http://www.onapsis.com/research/security-advisories/SAP-HANA-Information-Disclosure-via-SQL-IMPORT-FROM-statement
- 20150527 [Onapsis Security Advisory 2015-006] SAP HANA Information Disclosure via SQL IMPORT FROM statement mailing-list
- http://packetstormsecurity.com/files/132066/SAP-HANA-Information-Disclosure.html