The (1) SCTCREFRESHEXPORTTABCOMP, (2) SCTCREFRESHCHECKENV, and (3) SCTCTMSMAINTAINALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote authenticated users with certain permissions to execute arbitrary commands via vectors involving a CALL 'SYSTEM' statement, aka SAP Security Note 2260344.