ABAP : Insufficient authorization check

There is no authorization check or it is not implemented correctly.

If the code does not explicitly verify the credentials, then your application may be attacked.

Broken Authentication take the second place in the “OWASP Top 10 2017” web-application vulnerabilities ranking. Insufficient authorization check is the most common security defect associated with user authorization.

In ABAP systems, authorization is verified both implicitly (for example, before the transaction starts) and at the program level, using the AUTHORITY-CHECK statement.

After performing the AUTHORITY-CHECK procedure, you need to check the sy-subrc result. sy-subrc with a value of 0 means sufficient authorization. Since the other ABAP commands also change sy-subrc, be sure to check sy-subrc immediately after AUTHORITY-CHECK.

Calling the HR_READ_INFOTYPE_AUTHC_DISABLE function disables the authorization check on subsequent calls of HR_READ_INFOTYPE.