MB Connect Line mbCONNECT24 and mymbCONNECT24 SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the accountstatus view devices parameter of MB Connect Line's mbCONNECT24 and mymbCONNECT24 applications, all versions through 2.20.0. This vulnerability allows high-privileged remote attackers to exploit improper handling of special elements in a SQL UPDATE command. As a result, attackers could read the entire database and modify values in a non-critical table, leading to a complete loss of confidentiality and some degradation of integrity.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to manipulate database queries and potentially access or modify database information.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.20.1.