MB Connect Line mbCONNECT24 and mymbCONNECT24 SQL Injection Vulnerability

A remote SQL injection vulnerability has been identified in MB Connect Line's mbCONNECT24 and mymbCONNECT24 applications, specifically in versions 2.20.0 and prior. The vulnerability arises from inadequate sanitization of special characters in SQL SELECT commands, allowing unauthenticated attackers to manipulate database queries. This exploitation could lead to a complete loss of confidentiality by unauthorized access to sensitive database information.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to interfere with the application's database queries. This could result in unauthorized data access or manipulation.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instances to version 2.20.1.