title: SQL Injection vulnerability in SAP Business Planning and Consolidation MS
description: SAP BPC MS 10.0 - version 810, allows an unauthorized attacker to execute crafted database queries. The exploitation of this issue could lead to SQL injection vulnerability and could allow an attacker to access, modify, and/or delete data from the backend database.
problem types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
affected:
{
defaultStatus: unaffected
product: SAP BPC MS 10.0
vendor: SAP
versions:
status: affected, version: 800
status: affected, version: 810
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL