rapid7/metasploit-framework — pull request #1751 by andrewkabai (2013-04-22 15:44:54+00:00)
Title: Module/auxiliary sap configservlet exec noauth

Corrected pull request (branch change) for the previously submitted module:
https://github.com/rapid7/metasploit-framework/pull/1740

This module allows execution of operating system commands throug the
SAP ConfigServlet without any authentication.

The vulnerability was discovered by ERPScan's team, it was presented on Hacker Halted 2012 conference:
http://erpscan.com/wp-content/uploads/2012/11/Breaking-SAP-Portal-HackerHalted-2012.pdf