MB Connect Line SQL Injection Vulnerability in Mbconnect24 and Mymbconnect24

A remote SQL injection vulnerability has been identified in the 'setinfo' endpoint of MB Connect Line's mbCONNECT24 and mymbCONNECT24 applications, affecting versions 2.19.4 and prior. This vulnerability allows unauthenticated attackers to manipulate SQL UPDATE commands, leading to unauthorized write access to the user table. The flaw arises from inadequate sanitization of special characters in SQL commands, creating opportunities for injection attacks.

Impact

Exploitation of this vulnerability allows for arbitrary write access to the user table, potentially leading to unauthorized modifications of user data.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instances to version 2.19.5.