A critical SQL injection vulnerability in SAP Business Planning and Consolidation allows authenticated users to compromise data confidentiality, integrity, and availability.

This vulnerability stems from improper authorization checks, allowing an authenticated user to inject and execute malicious SQL queries against the underlying database. This permits the unauthorized reading, modification, or deletion of sensitive business data.

The ability to manipulate database contents directly poses a severe risk to organizational operations. With a CVSS score of 9.9, this flaw could lead to total loss of data integrity, unauthorized disclosure of sensitive financial or business information, and significant system downtime, potentially resulting in regulatory non-compliance and reputational damage.

Immediate Action: Apply the latest security patches provided by SAP for the affected Business Planning and Consolidation and Business Warehouse environments immediately.

Proactive Monitoring: Review database access logs for unusual query patterns, such as unexpected administrative commands or large-scale data export requests originating from standard user accounts.

Compensating Controls: Implement strict database-level permissions and utilize Database Activity Monitoring (DAM) to detect or block unauthorized SQL execution attempts.

Public Exploit Available: Unknown

Given the critical CVSS severity score of 9.9, organizations must prioritize the identification of all instances of SAP Business Planning and Consolidation and SAP Business Warehouse. Immediate patching is required to prevent authenticated attackers from leveraging this SQL injection flaw to compromise the integrity of the enterprise database.