Given a demo system for a fair which is based on SAP Netweaver ABAP. Our application has a bug which cannot be fixed easily, at least not in time for the fair. The workaround is to give the users of the demo SAP_ALL access rights.
SAP_ALL is a bad idea, I know. Please, let's not discuss that part. I did already and it will just be that way.
We do not care about the data in the system. It's an IDES demo system and we have a program that can delete the data (our application data) and reset it into the delivery or demo state. So it's not a big deal if someone manipulates data.
As a tester of that system, I have application knowlegde but not enough SAP administration knowledge. I wonder whether it would be possible to somehow transfer an executable to that server (via transaction CG3Z maybe) or create one on the server and later run it.
IMHO this would be an undiscussed attack surface and if it's possible, it would give me a new argument to talk to people again.
Maybe it's relevant: our application needs ICM (Internet Communication Manager) and HTTP, so a port will be open.