CVE-2021-33701

DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain access to Superuser account, leading to SQL Injection vulnerability, that highly impacts systems Confidentiality, Integrity and Availability.

• CWE-89
• CWE-89

• http://packetstormsecurity.com/files/165303/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/165304/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-ABAP-Code-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/Dec/35Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2021/Dec/36Exploit, Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/3078312Permissions Required, VDB Entry, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806Vendor Advisory
• http://packetstormsecurity.com/files/165303/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/165304/SAP-Netweaver-IUUC_RECON_RC_COUNT_TABLE_BIG-ABAP-Code-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/Dec/35Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2021/Dec/36Exploit, Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/3078312Permissions Required, VDB Entry, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806Vendor Advisory

Published

Sep 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33696SAP BusinessObjects Business Intelligence Platform (Crystal …5.4
• CVE-2021-33697Under certain conditions, SAP BusinessObjects Business Intel…6.1
• CVE-2021-33698SAP Business One, version - 10.0, allows an attacker with bu…8.8
• CVE-2021-33699Task Hijacking is a vulnerability that affects the applicati…6.5
• CVE-2021-3370DouPHP v1.6 was discovered to contain a cross-site scripting…6.1
• CVE-2021-33700SAP Business One, version - 10.0, allows a local attacker wi…7.8
• CVE-2021-33702Under certain conditions, NetWeaver Enterprise Portal, versi…6.1
• CVE-2021-33703Under certain conditions, NetWeaver Enterprise Portal, versi…6.1
• CVE-2021-33704The Service Layer of SAP Business One, version - 10.0, allow…8.8
• CVE-2021-33705The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30,…8.1
• CVE-2021-33706Due to improper input validation in InfraBox, logs can be mo…4.3
• CVE-2021-33707SAP NetWeaver Knowledge Management allows remote attackers t…6.1