MB Connect Line mbCONNECT24 and mymbCONNECT24 Unauthenticated SQL Injection Vulnerability

A remote SQL injection vulnerability has been identified in MB Connect Line's mbCONNECT24 and mymbCONNECT24 applications, specifically in the 'getLiveValues' function's 'tagid' parameter. This vulnerability arises from inadequate sanitization of special characters in a SQL SELECT command, allowing an unauthenticated attacker to manipulate SQL queries. Exploitation of this vulnerability could lead to a complete loss of confidentiality by unauthorized access to the database.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to interfere with the application's database queries. This could result in unauthorized data access or manipulation.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.20.1.