MB Connect Line mbCONNECT24 and mymbCONNECT24 Unauthenticated SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the MB Connect Line mbCONNECT24 and mymbCONNECT24 applications, specifically in the '_mb24api_getUserAccount' function. This vulnerability allows unauthenticated remote attackers to exploit improper handling of special elements in SQL SELECT commands, potentially leading to a complete loss of confidentiality by accessing sensitive database information.

Impact

Exploitation of this vulnerability allows for unauthorized SQL injection, enabling attackers to manipulate database queries and access or modify database information. In this case, it could result in unauthorized access to user account information.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instances to version 2.20.1.