The SAP Netweaver version 7.40 SP 12 SCTC_REFRESH_CHECK_ENV function does not correctly sanitize variables used when executing CALL 'SYSTEM' statement, allowing an attacker, with particular privileges, to execute any arbitrary OS command.
b35e9f6613d4f1f23468ca6d75fc9ed768d97653f4622f0c9116590ea888b4f4