description: DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain access to Superuser account, leading to SQL Injection vulnerability, that highly impacts systems Confidentiality, Integrity and Availability.
problem types: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection�)
affected:
{
product: DMIS Mobile Plug-In
vendor: SAP SE
versions:
status: affected, version: < DMIS 2011_1_620
status: affected, version: < 2011_1_640
status: affected, version: < 2011_1_700
status: affected, version: < 2011_1_710
status: affected, version: < 2011_1_730
status: affected, version: < 710
status: affected, version: < 2011_1_731
status: affected, version: < 2011_1_752
status: affected, version: < 2020
}
{
product: SAP S/4HANA
vendor: SAP SE
versions:
status: affected, version: < SAPSCORE 125
status: affected, version: < S4CORE 102
status: affected, version: < 102
status: affected, version: < 103
status: affected, version: < 104
status: affected, version: < 105
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.0
]