SAP CTC Service Verb Tampering (add user and add role)

This module exploits an authentication bypass vulnerability in SAP NetWeaver CTC service.
The service is vulnerable to verb tampering and allows for unauthorised user management.

SAP Note 1589525, 1624450 / DSECRG-11-041.

ref: http://erpscan.com/advisories/dsecrg-11-041-sap-netweaver-authentication-bypass-verb-tampering