The vulnerability of the OSCommand Console and the GPA_ADMIN transaction of the SAP Diagnostic Agent allows a perpetrator to execute arbitrary code.

The vulnerability of the OSCommand Console and the GPAADMIN transaction of the SAP Diagnostic Agent exists due to the failure to take measures to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2019-0330: Improper Control of Generation of Code

The OS Command Plugin in the transaction GPAADMIN and the OSCommand Console of SAP Diagnostic Agent LM-Service, version 7.2, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application...