कोड इंजेक्शन (Code Injection) भेद्यता SAP S/4HANA और SAP SCM (विशेषता प्रसार - Characteristic Propagation) में

The impact of CVE-2025-42967 is severe. Successful exploitation allows an attacker to execute arbitrary code on the affected SAP system with user privileges. This can lead to complete system takeover, enabling the attacker to access, modify, or delete sensitive data, install malware, or disrupt critical business operations. The ability to create a custom report with malicious code provides a highly effective attack vector, bypassing standard security controls. Given the widespread use of SAP systems in critical infrastructure and enterprise environments, the potential blast radius of this vulnerability is significant. This vulnerability shares similarities with other SAP RCE vulnerabilities where report customization features are exploited to gain unauthorized access and control.

Organizations heavily reliant on SAP S/4HANA and SAP SCM for critical business processes are at significant risk. This includes industries such as manufacturing, finance, and supply chain management. Systems with legacy configurations or those lacking robust access controls are particularly vulnerable. Shared hosting environments utilizing older SAP versions also present a heightened risk.

• linux / server:

journalctl -u <sap_service_name> | grep -i "characteristic propagation"

• generic web:

curl -I <sap_url>/sap/bc/ui2/ui2/browser?sap-client=<client_id>&fiori=/sap/ui2/view/main.html

• database (mysql):

SELECT * FROM <sap_tables> WHERE <column_name> LIKE '%characteristic propagation%';

1. 2025-07-08Disclosure

   disclosure

1. आरक्षित2025-04-16
2. प्रकाशित2025-07-08
3. संशोधित2026-02-26
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-42967 is to upgrade to a patched version of SAP S/4HANA and SAP SCM. Refer to the official SAP security note for the specific fixed version. If immediate patching is not possible, consider implementing temporary workarounds such as restricting user privileges related to report creation and modification. Implement strict input validation on any user-supplied data used in report generation. Monitor SAP system logs for suspicious activity related to report creation and execution. After upgrading, confirm the fix by attempting to create a report with potentially malicious code and verifying that the system prevents its execution.