MB connect line GmbH’s mbCONNECT24/mymbCONNECT24 contains an unauthenticated SQL injection flaw in the DeleteSysLogEntry function. Because the SQL DELETE statement is built without properly neutralizing special elements, a remote attacker can manipulate the query to read more data than intended and delete records from a non-critical table. The issue is reachable over the network and does not require user interaction; the provided CVSS indicates medium severity (CVSS 5.5) with high attack complexity requirements for privileges (PR:H) but high confidentiality impact (C:H).
The root cause is improper neutralization of special elements in a SQL DELETE command (CWE-89). In particular, the DeleteSysLogEntry function is vulnerable to SQL injection, meaning attacker-controlled input can alter the structure/logic of the generated DELETE query. The NVD description indicates the attacker can leverage this to read the whole database and delete entries in a non-critical table. The CERT-VDE advisory content provided here is limited: it confirms “multiple SQLi vulnerabilities” in mbCONNECT24/mymbCONNECT24 and that the vulnerabilities allow SQL injection in mbCONNECT24/mymbCONNECT24, but it does not include additional technical details such as exact parameter names, the full SQL statement, or a step-by-step exploitation sequence.
Impact is primarily confidentiality loss: the NVD description states the attacker can “read the whole database,” which corresponds to high confidentiality impact (C:H). Integrity impact is described as “some loss of integrity,” specifically via deletion of entries in a non-critical table. Availability impact is not indicated (A:N). Overall risk is medium (CVSS 5.5, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N). While the vulnerability is unauthenticated and network-reachable, the CVSS vector includes PR:H, suggesting exploitation may require the attacker to have some additional capability/privilege context beyond pure network access; however, the NVD explicitly characterizes it as a “high privileged remote attacker” scenario.
Mitigation: The supplied reference content does not include patched version numbers, vendor fixes, or concrete workarounds. The CERT-VDE advisory indicates multiple SQLi vulnerabilities in mbCONNECT24/mymbCONNECT24 but the excerpt provided stops before listing affected versions, remediation steps, or detection guidance. As a result, the only safe, source-backed recommendation is to treat mbCONNECT24/mymbCONNECT24 as vulnerable and apply vendor-provided patches/fixes for the SQL injection issues (including the DeleteSysLogEntry function) once available from MB connect line GmbH or the advisory’s full publication details. If immediate patching is not possible, reduce exposure by limiting network access to the service hosting mbCONNECT24/mymbCONNECT24 (since the attack vector is NETWORK) and monitor for anomalous requests targeting log deletion or SQLi-like payloads, but no specific detection signatures are present in the provided material.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
CWE-89