SAP shouldn't require
a consultant to survive.

SQL Injection in SAP S/4HANA Enterprise Search

Unsanitised user input is concatenated directly into SQL queries in the Enterprise Search component, allowing an authenticated attacker to inject arbitrary SQL statements. Impact is primarily on confidentiality and availability — unauthorised database access and information disclosure are possible.

Missing Authentication Check in SAP Commerce Cloud Configuration Upload

An overly permissive Spring Security configuration with incorrect rule ordering allows unauthenticated users to access the configuration upload functionality. An attacker can upload malicious configuration that triggers code injection, resulting in arbitrary server-side code execution. The fix requires a rebuild and redeployment of the affected application.

OS Command Injection in SAP Forecasting & Replenishment

Insufficient control over operating system commands in five function modules allows an authenticated attacker with administrative authorisations to execute arbitrary OS commands. The affected functions are not remote-enabled, but exploitation by a privileged user has high impact on confidentiality, integrity, and availability.