ULTRA RED's research team discovered a chained vulnerability in SAP Fieldglass that combined Blind XSS with SQL injection through log poisoning. The vulnerability was reported to SAP, fixed in December 2024, and ULTRA RED was credited in SAP's security advisory.
The attack chain
Step 1 — Blind XSS via unsanitized input
A blind XSS payload was injected into SAP Fieldglass input fields. Unlike standard reflected XSS where the payload executes immediately, blind XSS payloads execute when an administrator views a page containing the poisoned content — in this case, the application's log viewer in the admin dashboard.
Step 2 — Admin dashboard fetches unsanitized logs
The admin dashboard retrieved and displayed log entries without sanitizing their content. When an administrator viewed the logs, the blind XSS payload executed in the context of their authenticated admin session.
Step 3 — SQL query capability exploitation
The admin dashboard included functionality to execute SQL queries directly against the database. With XSS executing in the admin's browser context, the attacker could: extract the CSRF token from the DOM, craft a SQL query, and auto-submit it using the admin's authenticated session.
Impact: The attacker could access multiple databases through the admin SQL interface, potentially extracting, modifying, or deleting sensitive data.
Disclosure timeline
October 25, 2024: Reported to SAP
October 28, 2024: SAP confirmed the vulnerability
December 2, 2024: SAP released a fix
December 10, 2024: ULTRA RED credited in SAP's security advisory
This case demonstrates the importance of sanitizing log content before display, avoiding administrative SQL interfaces in web UIs, and the chain-exploitation potential that arises when multiple lower-severity findings are combined.
