MB Connect Line mbCONNECT24 and mymbCONNECT24 Unauthenticated SQL Injection Vulnerability

A remote SQL injection vulnerability has been identified in the userinfo endpoint of MB connect line mbCONNECT24 and mymbCONNECT24, all versions through 2.20.0. This vulnerability allows an unauthenticated attacker to exploit improper handling of special elements in a SQL SELECT command, potentially leading to a complete loss of confidentiality by accessing sensitive database information.

Impact

Exploitation of this vulnerability allows for unauthorized SQL injection, enabling attackers to manipulate database queries and access or modify database information. In this case, it could lead to a total loss of confidentiality by allowing unauthorized access to sensitive data.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.20.1.