CVE-2023-49581— SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
Quick assessment
Affected
SAP_SE SAP NetWeaver Application Server ABAP and ABAP Platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP GUI是德国思爱普（SAP）公司的一个应用软件。SAP系统的图形用户界面。 SAP GUI存在信息泄露漏洞，该漏洞源于允许未经身份验证的攻击者访问内部信息。
Possible ATT&CK Techniques 3 AI
T1496 · Resource Hijacking T1530 · Data from Cloud Storage T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-49581
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
Source: CVE Program / CVE List V5
Vulnerability Description
SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doing so the attacker could increase response times of the AS ABAP, leading to mild impact on availability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
SAP GUI 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP GUI是德国思爱普（SAP）公司的一个应用软件。SAP系统的图形用户界面。 SAP GUI存在信息泄露漏洞，该漏洞源于允许未经身份验证的攻击者访问内部信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP NetWeaver Application Server ABAP and ABAP Platform | SAP_BASIS 700 | - |
|
II. Public POCs for CVE-2023-49581
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-49581
请登录查看更多情报信息。
Other References for CVE-2023-49581 (2)
Same Patch Batch · SAP_SE · 2023-12-12 · 16 CVEs total
| CVE-2023-49583 | 9.1 CRITICAL | Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/ |
| CVE-2023-50422 | 9.1 CRITICAL | Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-se |
| CVE-2023-50423 | 9.1 CRITICAL | Escalation of Privileges in SAP BTP Security Services Integration Library ([Python] cloud- |
| CVE-2023-50424 | 9.1 CRITICAL | Escalation of Privileges in SAP BTP Security Services Integration Library ([Golang] github |
| CVE-2023-42481 | 8.1 HIGH | Improper Access Control vulnerability in SAP Commerce Cloud |
| CVE-2023-42478 | 7.5 HIGH | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Plat |
| CVE-2023-49580 | 7.3 HIGH | Information disclosure in SAP GUI for Windows and SAP GUI for Java |
| CVE-2023-6542 | 7.1 HIGH | Improper Export of Android Application Components in SAP EMARSYS SDK ANDROID |
| CVE-2023-42476 | 6.8 MEDIUM | Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence |
| CVE-2023-49587 | 6.4 MEDIUM | Command Injection vulnerability in SAP Solution Manager |
| CVE-2023-42479 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct |
| CVE-2023-49577 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution) |
| CVE-2023-49584 | 4.3 MEDIUM | Client-Side Desynchronization vulnerability in SAP Fiori Launchpad |
| CVE-2023-49058 | 3.5 LOW | Directory Traversal vulnerability in SAP Master Data Governance |
| CVE-2023-49578 | 3.5 LOW | Denial of service (DOS) in SAP Cloud Connector |
IV. Related Vulnerabilities
Same product: SAP NetWeaver Application Server ABAP and ABAP Platform
-
CVE-2026-58236
OS Command Injection vulnerability in Application Server ABA -
CVE-2026-0509
Missing Authorization check in SAP NetWeaver Application Ser -
CVE-2026-0506
Missing Authorization check in SAP NetWeaver Application Ser -
CVE-2025-42969
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Ap -
CVE-2025-31329
Information Disclosure vulnerability in SAP NetWeaver Applic
Same vendor: SAP_SE
-
CVE-2026-76974
Information Disclosure vulnerability in SAP Fiori Launchpad -
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist -
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration -
CVE-2026-76969
Credential disclosure in multitenant applications using SAP -
CVE-2026-76968
Information Disclosure vulnerability in SAP Web Dispatcher,
Same weakness: CWE-89
-
CVE-2026-18443
Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL In -
CVE-2026-96267
WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthent -
CVE-2026-103913
GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via -
CVE-2026-94539
SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injectio -
CVE-2026-95865
Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Con
V. Comments for CVE-2023-49581
No comments yet