T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/rfc_function_caller.py:80- Finding
Arbitrary SAP RFC Function Execution Without an Allowlist
- Content
View full analysis
Dict[str, Any]: """ Execute SAP function module with parameters Args: function_name: Name of RFC function module parameters: Dictionary of input parameters save_result: Whether to save result to file output_file: Custom output filename Returns: Dictionary containing function result """ try: print(f"🔄 Calling function: {function_name}") # Execute function call if parameters: result = self.conn.call(function_name, **parameters) else: result = self.conn.call(function_name) print(f"✅ Function executed successfully") # Save result if requested if save_result or output_file: filename = output_file or f"{function_name}_{datetime.now().strftime('%Y%m%d_%H%M%S')}.json" self.save_result(result, filename) return result except Exception as e: print(f"❌ Error calling function {function_name}: {str(e)}") return {} ``` ```python else: # Direct function call mode function_name = sys.argv[2] parameters = {} # Load parameters from file if provided if len(sys.argv) > 3: try: with open(sys.argv[3], 'r') as f: parameters = json.load(f) except Exception as e: print(f"❌ Error loading parameters: {str(e)}") sys.exit(1) # Execute function result = caller.call_function(function_name, parameters, save_result=True) if result: print(f"\n📋 Function Result:") print(caller.format_result(result)) ``` ### ...[truncated 1924 chars]- Remediation
View remediation