MB Connect Line mbCONNECT24 and mymbCONNECT24 SQL Injection Vulnerability

A SQL injection vulnerability has been identified in MB Connect Line's mbCONNECT24 and mymbCONNECT24 applications, specifically in the RemoveRequest function. This vulnerability allows high-privileged remote attackers to exploit improper handling of special elements in SQL DELETE commands. As a result, attackers can read the entire database and delete entries from a non-critical table, leading to a complete loss of confidentiality and some loss of integrity.

Impact

Exploitation of this vulnerability allows for unauthorized SQL injection, enabling attackers to manipulate database queries. This could result in unauthorized data access, data modification, or deletion of database entries, depending on the attacker's intentions.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instances to version 2.20.1.