CVE-2025-42889

CVE-2025-42889 is a vulnerability in SAP Starter Solution that allows an authenticated attacker to execute crafted database queries. The root cause is insufficient input validation or improper handling of user-supplied data, enabling the attacker to manipulate database queries and access underlying data.

To exploit this vulnerability, an attacker must have valid authentication credentials for the SAP Starter Solution. Once authenticated, they can craft malicious database queries that are executed by the application, bypassing intended restrictions. The attack does not require any special network position beyond access to the application.

The impact is limited to low confidentiality and integrity loss, as the attacker can read or modify certain database contents but cannot cause a denial of service. No availability impact is reported.

SAP has addressed this vulnerability through its regular Security Patch Day process [1]. Customers are advised to apply the relevant security notes provided by SAP, which are available for supported versions in the latest support packages [1].