MB Connect Line mbCONNECT24 and mymbCONNECT24 SQL Injection Vulnerability

A SQL injection vulnerability has been identified in MB Connect Line's mbCONNECT24 and mymbCONNECT24 products, specifically in versions 2.20.0 and prior to 2.20.0. This vulnerability allows low-privileged remote attackers to exploit the 'getWidgetTags' function, where improper handling of special elements in a SQL SELECT command creates an opportunity for injection. The exploitation of this vulnerability could lead to a complete loss of confidentiality by allowing unauthorized access to the database.

Impact

Exploitation of this vulnerability allows for SQL injection, which could be used to manipulate database queries and potentially access, modify, or delete database information.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.20.1.