A critical SQL injection vulnerability in SAP Business Planning and Consolidation and Business Warehouse allows authenticated attackers to manipulate, exfiltrate, or destroy sensitive database data.

This is an SQL injection vulnerability arising from insufficient authorization checks. An authenticated user can supply crafted SQL statements to the application to interact directly with the backend database.

The ability for an authenticated user to perform unauthorized SQL operations poses a major risk to the confidentiality, integrity, and availability of sensitive business data. With a CVSS score of 9.9, this vulnerability could allow an attacker to bypass business logic, escalate privileges, or completely wipe critical enterprise databases.

Immediate Action: Apply the relevant SAP Security Notes (referenced in SAP Note 3719353) to address the authorization and input validation gaps.

Proactive Monitoring: Audit database logs for unusual SQL queries, particularly those involving unexpected table modifications or mass data exports, initiated by standard user accounts.

Compensating Controls: Ensure that database service accounts operate with the principle of least privilege, restricting the ability of the application to execute destructive SQL commands.

Public Exploit Available: Unknown — there is no confirmed evidence of public exploits or weaponized code in the provided data.

SAP environments are critical to business operations, and this vulnerability represents a severe threat. Organizations must consult SAP Security Note 3719353 immediately and apply the necessary patches to protect against potential database compromise.