MB Connect Line mbCONNECT24 and mymbCONNECT24 Unauthenticated SQL Injection Vulnerability

A remote SQL injection vulnerability has been identified in MB Connect Line's mbCONNECT24 and mymbCONNECT24 products, specifically in versions 2.20.0 and prior. This vulnerability allows unauthenticated attackers to exploit the sync_data24 task by improperly neutralizing special elements in a SQL SELECT command, leading to a complete loss of confidentiality.

Impact

Exploitation of this vulnerability allows for unauthorized SQL injection, potentially leading to unauthorized access or manipulation of the database.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.20.1.