External customers are able to create additional columns in the opt-out table in SAS Digital Marketing. The update occurs when the e-mail recipient opens a broadcast e-mail message and clicks on the option to opt-out of receiving future broadcasts. Tracked variables within the broadcast create new columns in the opt-out table, if they do not already exist. This ability to update the SAS Digital Marketing opt-out table leaves it vulnerable to malicious corruption or SQL injection attacks. You can minimize the extent of any malicious updates by protecting the table with appropriate database user permissions.

Click the Hot Fix tab in this note to access the hot fix for this issue.

The hot fix for this problem uses an existing advanced server property, PreventDDL. After you apply the hot fix, set the property to true to prevent the DDL statements (CREATE TABLE and ALTER TABLE) from being available in the tracking tier. By default, the property is set to false to enable you to create or alter a response table and opt-out table through bess.war.

After you change the advanced server property PreventDDL, perform the following two steps:

1. Reconfigure the bess.war web application using the SAS Digital Marketing Configuration Wizard.
2. Redeploy the bess.war web application to all machines where bess.war installed.

If you are using this property, ensure that all variables that you want to track are created using the SAS Digital Marketing Broadcast Creation Wizard. If subsequent tracked variables are added to the broadcast via the editor or externally, then you must manually create the appropriate columns in both the SAS Digital Marketing response table and opt-out table. If you do not create the columns manually, the click events will not be recorded in the response table and the opt-outs will not be recorded in the opt-out table.

See SAS Note 43762 "The SAS Digital Marketing response table is vulnerable to malicious corruption" for additional details.

Operating System and Release Information

A fix for this issue for SAS Digital Marketing 5.4_M1 is available at:

A fix for this issue for SAS Digital Marketing 5.41 is available at:

A fix for this issue for SAS Digital Marketing 6.1_M1 is available at: