Menu
Fake patient data could have been uploaded through SAP medical app

Fake patient data could have been uploaded through SAP medical app

SAP has patched the issue, which affected Electronic Medical Records Unwired

SAP has fixed two flaws in a mobile medical app, one of which could have allowed an attacker to upload fake patient data.

The issues were found in SAP's Electronic Medical Records (EMR) Unwired, which stores clinical data about patients including lab results and images, said Alexander Polyakov, CTO of ERPScan, a company based in Palo Alto, California, that specializes in enterprise application security.

Researchers with ERPScan found a local SQL injection flaw that could allow other applications on a mobile device to get access to an EMR Unwired database. That's not supposed to happen, as mobile applications are usually sandboxed to prevent other applications from accessing their data.

"For example, you can upload malware to the phone, and this malware will be able to get access to this embedded database of this health care application," Polyakov said in a phone interview.

They also found another issue in EMR Unwired where an attacker could tamper with a configuration file and then change medical records stored on the server, according to an ERPScan advisory.

"You can send fake information about the medical records, so you can imagine what can be done after that," Polyakov said. "You can say, 'This patient is not ill'."

SAP fixed both of the issues about a month ago, Polyakov said.

The German software giant also fixed another flaw about a week ago found by ERPScan researchers, which affected its Mobile Device Management software, a mobile client that allows access to the company's other business applications.

The issue was a server-side buffer overflow that could cause a denial-of-service attack, according to an advisory. That may not seem serious, but that server software accepts supply-chain reports from the field and is also used by executives to get access to business-critical data, Polyakov said.

"If you can disable the mobile server for at least an hour, the supply chain of the company can be stopped, so you can imagine how bad it can be for a company," Polyakov said.

The vulnerability is not remotely exploitable, so an attacker would need to have access to a SAP Mobile Device Management client, he said. But that would be accessible from inside the company and possibly from third-parties, he added.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags applicationssecurityenterprise resource planningSAPsoftwareExploits / vulnerabilitiesERPScanbusiness intelligence

Featured

Slideshows

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

Revealed at a glitzy bash in Sydney at the Ivy Penthouse, the first StorageCraft Partner Awards locally saw the vendor honour its top-performing partners with ASI Solutions, SMBiT Pro, Webroot, ACA Pacific and Soft Solutions New Zealand taking home the top awards. Photos by Maria Stefina.

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards
Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

​Synnex and Lenovo hosted 18 resellers for an action-packed weekend adventure in RotoVegas, taking in white water rafting on the Kaituna River, as well as quad biking and dinner at Stratosfare​, overlooking Lake Rotorua at the top of Mount Ngongotaha​. Photos by Synnex.

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip
Show Comments