Fake patient data could have been uploaded through SAP medical app

SAP has patched the issue, which affected Electronic Medical Records Unwired

SAP has fixed two flaws in a mobile medical app, one of which could have allowed an attacker to upload fake patient data.

The issues were found in SAP's Electronic Medical Records (EMR) Unwired, which stores clinical data about patients including lab results and images, said Alexander Polyakov, CTO of ERPScan, a company based in Palo Alto, California, that specializes in enterprise application security.

Researchers with ERPScan found a local SQL injection flaw that could allow other applications on a mobile device to get access to an EMR Unwired database. That's not supposed to happen, as mobile applications are usually sandboxed to prevent other applications from accessing their data.

"For example, you can upload malware to the phone, and this malware will be able to get access to this embedded database of this health care application," Polyakov said in a phone interview.

They also found another issue in EMR Unwired where an attacker could tamper with a configuration file and then change medical records stored on the server, according to an ERPScan advisory.

"You can send fake information about the medical records, so you can imagine what can be done after that," Polyakov said. "You can say, 'This patient is not ill'."

SAP fixed both of the issues about a month ago, Polyakov said.

The German software giant also fixed another flaw about a week ago found by ERPScan researchers, which affected its Mobile Device Management software, a mobile client that allows access to the company's other business applications.

The issue was a server-side buffer overflow that could cause a denial-of-service attack, according to an advisory. That may not seem serious, but that server software accepts supply-chain reports from the field and is also used by executives to get access to business-critical data, Polyakov said.

"If you can disable the mobile server for at least an hour, the supply chain of the company can be stopped, so you can imagine how bad it can be for a company," Polyakov said.

The vulnerability is not remotely exploitable, so an attacker would need to have access to a SAP Mobile Device Management client, he said. But that would be accessible from inside the company and possibly from third-parties, he added.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags applicationssecurityenterprise resource planningSAPsoftwareExploits / vulnerabilitiesERPScanbusiness intelligence

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Essentials

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?