External customers are able to create and update response tables and columns in SAS Digital Marketing. The update occurs when the e-mail recipient opens a broadcast e-mail message and clicks the links. However, this ability to update the SAS Digital Marketing response table leaves it vulnerable to malicious corruption or SQL injection attacks. You can minimize the extent of any malicious updates by protecting the table with appropriate database user permissions.

For SAS Digital Marketing 5.4_M1, click the Hot Fix tab in this note to access the hot fix for this issue.

A hot fix for SAS Digital Marketing 5.3 is available upon request from Technical Support.

The hot fix for this problem introduces a new advanced server property, PreventDDL. After you apply the hot fix, set the property to true to prevent the DDL statements (CREATE TABLE and ALTER TABLE) from being available in the tracking tier. By default, the property is set to false to enable you to create or alter a response table through bess.war.

After you change the advanced server property PreventDDL, perform the following two steps:

1. Reconfigure the bess.war web application using the SAS Digital Marketing Configuration Wizard.
2. Redeploy the bess.war web application to all machines where bess.war installed.

If you are using this property, ensure that all variables that you want to track are created using the SAS Digital Marketing broadcast creation wizard. If subsequent tracked variables are added to the broadcast via the editor or externally, then you must manually create the appropriate columns in the SAS Digital Marketing response table. If you do not create the columns manually, the click events will not be recorded.

The hot fix allows for the creation of standard columns in the response table, limited to these: BESSEVENT, BESSTIME, JAVATIME, REMOTEHOST, REMOTEUSER, REMOTEIPADDRESS, CONTENT,LINKID, LINK, BROWSER, AOL, CT, APPID, RSS, ITEM, BROADCAST, RTC, S1, MM_LAT, MM_LONG, MM_ZIP, MM_AREA, MM_CITY, MM_COUNTRY.

See SAS Note 50612 "The SAS Digital Marketing opt-out table is vulnerable to malicious corruption, for additional information."

Operating System and Release Information

A fix for this issue for SAS Digital Marketing 5.4_M1 is available at: