EUVD-2026-55882
GHSA-wm86-5vhp-x9q6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Network-accessible injection requiring only a low-privilege account; DDL impact is structurally significant but vendor-rated Low across all CIA dimensions with no scope change.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
1DescriptionCVE.org
Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definition Language) string into the underlying database without further authorization. Successful exploitation could allow the attacker to make malicious changes to the database structure, resulting in a low impact to the confidentiality, integrity, and availability of the system.
AnalysisAI
SQL DDL injection in SAP Social Intelligence (versions 102-109) allows an authenticated low-privilege network attacker to directly execute Data Definition Language commands against the underlying database. Exploitation can alter or destroy database schema objects - a more structurally damaging capability than typical DML injection - with vendor-rated Low impact across confidentiality, integrity, and availability. No active exploitation confirmed at time of analysis and no public exploit identified; patch details are available via SAP Security Note 3766473.
Technical ContextAI
SAP Social Intelligence is an SAP SE enterprise application covered by CPE cpe:2.3:a:sap_se:sap_social_intelligence:*:*:*:*:*:*:*:* across affected releases 102 through 109 (including S4FND 102). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Critically, the injectable payload class is SQL DDL - statements such as CREATE, DROP, or ALTER - rather than the more common DML (SELECT/INSERT/UPDATE/DELETE). DDL injection gives an attacker structural control over database schema objects, potentially enabling table drops, schema corruption, or persistent backdooring of database structure, which carries inherently higher operational risk than the Low CVSS impact ratings alone might suggest.
RemediationAI
Apply the patch documented in SAP Security Note 3766473 (https://me.sap.com/notes/3766473), released as part of SAP Security Patch Day (https://url.sap/sapsecuritypatchday). The exact remediated version is not independently confirmed from available data beyond the SAP advisory reference - consult the note directly for target release levels across affected tracks (102-109, S4FND 102). As a compensating control prior to patching, restrict access to SAP Social Intelligence application accounts to the minimum necessary user population, and review whether low-privilege roles require access to the specific input surfaces implicated in the DDL injection path. Audit database-level permissions for the application service account to ensure it cannot execute DDL statements; removing DDL privileges from the application's database user would directly neutralize the vulnerability's most severe impact, though this may affect legitimate application functionality and should be tested before deployment.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today