A lazy way to find out you fellow worker's salary, or SAP HR security
No ratings
Presented at Positive Hack Days 2012 by
SAP ERP Human Capital Management (HCM) is a software solution helping to manage company’s human resources and to handle payroll processes among other things. Therefore, its architectural flaws and implementation faults allow hackers to inflict considerable financial damage on the business, and sometimes all it takes is to obtain user privileges of an ordinary HR specialist. Attackers can leverage accounting defects that allow paying former or non-existent employees, making unapproved and hand-operated payments, etc. The report covers the most common ways of attacking this business application by exploiting its weaknesses, as well as methods for detecting and fixing such vulnerabilities.