The SAP Netweaver version 7.40 SP 12 SCTC_REFRESH_EXPORT_TAB_COMP function does not correctly sanitize variables used when executing CALL ‘SYSTEM’ statement, allowing an attacker, with particular privileges, to execute any arbitrary OS command.