EUVD-2026-43593
GHSA-9962-7h22-692x
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L
Retaining AV:N and PR:H from vendor vector; C:H reflects database exposure potential, consistent with SQL injection root cause despite prose ambiguity.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
1DescriptionCVE.org
SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability of the application.
AnalysisAI
SQL injection in SAP S/4HANA Project Management (PPM-PRO) allows a high-privileged authenticated attacker to execute crafted database queries, exposing backend database contents. The vulnerability is reachable over the network but requires both high attack complexity and high privilege level, significantly constraining the realistic attacker pool. No public exploit or active exploitation has been identified at time of analysis, and the CVSS base score of 5.5 reflects these mitigating factors despite the potential for database exposure.
Technical ContextAI
CWE-89 (SQL Injection) indicates that user-controlled input reaches a database query constructor without adequate sanitization or parameterization within the PPM-PRO module of SAP S/4HANA. SAP S/4HANA is SAP's next-generation ERP suite running on the HANA in-memory database platform. The affected component is identified via CPE cpe:2.3:a:sap_se:sap_s/4hana_project_management_(ppm-pro):*:*:*:*:*:*:*:* with no version range bounded, implying broad version exposure. The HANA database backend is a high-value target in enterprise environments, making database exposure particularly sensitive even if integrity and availability are less impacted. The AC:H designation in the CVSS vector suggests the injection requires specific conditions or crafting beyond a trivial payload.
RemediationAI
Apply the patch or correction instructions detailed in SAP Security Note 3537373 (https://me.sap.com/notes/3537373), accessible via SAP One Support Launchpad. SAP releases security corrections through its monthly Security Patch Day cycle; consult https://url.sap/sapsecuritypatchday for the relevant patch release and transport instructions. An exact fixed version number is not independently confirmable from available data - consult the SAP Note directly for the ABAP correction level or support package required. As a compensating control prior to patching, restrict access to the PPM-PRO module exclusively to the minimum set of roles that require it, enforcing SAP authorization object checks to reduce the population of high-privilege users who could trigger the injection. No additional workaround details are available from the references provided.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today