MB Connect Line mbCONNECT24 and mymbCONNECT24 Unauthenticated SQL Injection Vulnerability

A vulnerability allowing unauthenticated remote SQL injection has been identified in MB Connect Line's mbCONNECT24 and mymbCONNECT24 applications, specifically in the mb24alarm.php file's _mb24confi_getTagAlarm function. This vulnerability arises from inadequate sanitization of special elements in a SQL SELECT command, potentially leading to a complete loss of confidentiality.

Impact

Exploitation of this vulnerability allows for SQL injection, which could be used to manipulate database queries and access or modify database information.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.20.1.