CVE-2021-21465

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system.

• CWE-89

• http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/2986980Permissions Required
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476Vendor Advisory
• http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/2986980Permissions Required
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476Vendor Advisory

Published

Jan 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-2146Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-21460SAP 3D Visual Enterprise Viewer, version - 9, allows a user …8.8
• CVE-2021-21461SAP 3D Visual Enterprise Viewer, version - 9, allows a user …8.8
• CVE-2021-21462SAP 3D Visual Enterprise Viewer, version - 9, allows a user …8.8
• CVE-2021-21463SAP 3D Visual Enterprise Viewer, version - 9, allows a user …8.8
• CVE-2021-21464SAP 3D Visual Enterprise Viewer, version - 9, allows a user …4.3
• CVE-2021-21466SAP Business Warehouse, versions 700, 701, 702, 711, 730, 73…8.8
• CVE-2021-21467SAP Banking Services (Generic Market Data) does not perform …4.3
• CVE-2021-21468The BW Database Interface does not perform necessary authori…6.5
• CVE-2021-21469When security guidelines for SAP NetWeaver Master Data Manag…7.5
• CVE-2021-2147Vulnerability in the Oracle ZFS Storage Appliance Kit produc…1.8
• CVE-2021-21470SAP EPM Add-in for Microsoft Office, version - 1010 and SAP …4.4