SAP patches critical command injection vulnerabilities