MB Connect Line mbCONNECT24 Unauthenticated Blind SQL Injection Vulnerability

A blind SQL injection vulnerability has been identified in the mb24api endpoint of MB Connect Line's mbCONNECT24 and mymbCONNECT24 products, all versions through 2.19.4. This vulnerability allows unauthenticated remote attackers to exploit improper neutralization of special elements in SQL SELECT commands, leading to arbitrary read access to the entire database and a complete loss of confidentiality.

Impact

Exploitation of this vulnerability allows for unauthenticated blind SQL injection, resulting in arbitrary read access to the complete database and a total loss of confidentiality.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.19.5.