PFL_CHECK_OS_FILE_EXISTENCE (file existence and SMB relay)

This module exploits the SAP NetWeaver PFL_CHECK_OS_FILE_EXISTENCE Missing Authorisation Check and SMB Relay Vulnerability. It can be exploited remotely using RFC or webrfc without any additional authorisation by the user. Additionally it can be exploited via transaction SE37.

SAP Note 1591146 / DSECRG-12-009.

ref: http://erpscan.com/advisories/dsecrg-12-009-sap-netweaver-pfl_check_os_file_existence-missing-authorisation-check-and-smb-relay-vulnerability/