MB Connect Line mbCONNECT24 and mymbCONNECT24 SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the dashboard view of MB Connect Line's mbCONNECT24 and mymbCONNECT24 products, specifically in firmware versions through 2.20.0. This vulnerability allows low-privileged remote attackers to exploit improper handling of special elements in SQL SELECT commands, leading to a complete loss of confidentiality by accessing unauthorized database information.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to manipulate database queries and potentially access, modify, or delete database information.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.20.1.