MB Connect Line mbCONNECT24 and mymbCONNECT24 Unauthenticated SQL Injection Vulnerability in the getinfo Endpoint

A vulnerability allowing unauthenticated SQL injection has been identified in the MB Connect Line mbCONNECT24 and mymbCONNECT24 applications, specifically within the getinfo endpoint. This vulnerability arises from improper handling of special elements in SQL SELECT commands, enabling remote attackers to manipulate queries and access database information. As a result, there is a complete loss of confidentiality, with attackers potentially exploiting this flaw to read arbitrary data from the database.

Impact

Exploitation of this vulnerability allows for unauthenticated SQL injection, resulting in arbitrary read access to the entire database, according to the VDE advisory.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.19.5.