MB Connect Line mbCONNECT24 and mymbCONNECT24 SQL Injection Vulnerability

A SQL injection vulnerability has been identified in MB Connect Line's mbCONNECT24 and mymbCONNECT24 products, specifically in versions 2.20.0 and prior to 2.20.0. This vulnerability allows high-privileged remote attackers to exploit the 'getAccountByID' function, leading to a complete loss of confidentiality. The issue arises from improper handling of special elements in a SQL SELECT command, which could be manipulated to access or modify database information.

Impact

Exploitation of this vulnerability allows for SQL injection, with the potential to access or manipulate the database in ways that could compromise data confidentiality.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.20.1.