MB Connect Line mbCONNECT24 and mymbCONNECT24 Unauthenticated SQL Injection Vulnerability

A low-privileged remote attacker can exploit an unauthenticated SQL injection vulnerability in the 'getProjectScalings' function of MB Connect Line's mbCONNECT24 and mymbCONNECT24 applications, all versions through 2.20.0. The vulnerability arises from improper handling of special elements in a SQL SELECT command, potentially leading to a complete loss of confidentiality by allowing unauthorized access to the database.

Impact

Exploitation of this vulnerability allows for SQL injection, which could be used to manipulate database queries and access or modify database information unauthorizedly. In this case, it could result in a total loss of confidentiality.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.20.1.