MB Connect Line mbCONNECT24 and mymbCONNECT24 Unauthenticated SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the dsgvo_contracts view of MB Connect Line's mbCONNECT24 and mymbCONNECT24 products, all versions through 2.20.0. This vulnerability allows high-privileged remote attackers to exploit improper handling of special elements in SQL SELECT commands, leading to a complete loss of confidentiality.

Impact

Exploitation of this vulnerability allows for unauthorized SQL injection, potentially leading to unauthorized access to the database and its contents.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.20.1.