Dmitry Chastukhin

The issue exists due to insufficient protection of the web page structure in the Device Inspector page of the SAP Afaria mobile device management program. This allows a remote attacker to inject arbitrary HTML code using a specially crafted request. The vulnerability can be exploited by injecting arbitrary web script or HTML via crafted client name data in the Client form on the Device Inspector page.

The issue allows remote attackers to send requests to intranet servers via crafted XML, exploiting an XML external entity (XXE) vulnerability.

The issue allows remote attackers to obtain sensitive information. This can be achieved via the `ReadProfile` parameters in the SAP Management Console. Additionally, the vulnerability exists due to a lack of restrictions on remote function calls, specifically the `GetSystemInstanceList` function. An attacker can exploit this by sending a specially crafted SOAP request to gain information about the integration platform and operating system.