This vulnerability in SAP S/4HANA (On-Premise) involves improper neutralization of special elements in SQL commands (CWE-89), enabling an authenticated attacker to perform SQL injection through a remote-enabled function module. Exploitation could lead to unauthorized disclosure of sensitive information stored in the database. The issue affects versions S4FND 102 through 109. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No official patch or remediation level has been published by the vendor as of now.

The vulnerability allows unauthorized disclosure of sensitive information from the database, impacting confidentiality. There is no impact on data integrity or availability of the SAP S/4HANA application. Exploitation requires authenticated access, limiting the attack surface to users with some level of privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected SAP S/4HANA versions to trusted users only and monitor for unusual database query activity. Follow SAP's security recommendations and await official updates for remediation.