MB Connect Line mbCONNECT24 and mymbCONNECT24 Unauthenticated SQL Injection Vulnerability

A SQL injection vulnerability has been identified in MB Connect Line's mbCONNECT24 and mymbCONNECT24 products, specifically in versions 2.20.0 and prior to 2.20.0. This vulnerability allows an unauthenticated remote attacker to exploit improper handling of special elements in a SQL SELECT command, leading to a complete loss of confidentiality by accessing unauthorized database information.

Impact

Exploitation of this vulnerability allows for unauthorized access to the database, potentially leading to a complete loss of confidentiality.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.20.1.