MB connect line GmbH’s mbCONNECT24 / mymbCONNECT24 contains an unauthenticated SQL injection weakness in the getProjectScalings function. A low-privileged remote attacker can send crafted network requests to manipulate the SQL SELECT logic, potentially leading to a total loss of confidentiality. The issue is classified as CWE-89 (SQL Injection) with a CVSS v3.1 score of 6.5 (Medium) and vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
The root cause is described as “improper neutralization of special elements in a SQL SELECT command” within the getProjectScalings function. The attack vector is network-based, and the vulnerability is reachable without authentication (unauthenticated SQLi is explicitly stated in the NVD description). In practice, this means the application likely builds a SQL SELECT query using user-controlled input without correctly parameterizing or escaping special characters, allowing an attacker to alter the intended query semantics. The provided reference content (CERT-VDE advisory VDE-2026-044) states that multiple SQLi vulnerabilities were found in mbCONNECT24/mymbCONNECT24, but the excerpt does not include additional technical details such as exact query strings, parameter names, or specific code paths beyond the getProjectScalings function referenced by the NVD description.
Impact is focused on confidentiality: the NVD description states the vulnerability can result in a “total loss of confidentiality,” while integrity and availability are not indicated as directly impacted (I:N/A:N in the CVSS vector). The CVSS score of 6.5 (Medium) reflects that exploitation is feasible over the network with low complexity (AC:L) and requires low privileges (PR:L), with no user interaction (UI:N). The blast radius is therefore primarily data exposure from the affected application/database context, with real-world risk depending on what data the getProjectScalings query returns and how the database is permissioned.
Mitigation guidance is not present in the provided reference excerpt. Based on the vulnerability type (SQL injection), the appropriate remediation is to fix the getProjectScalings query handling by using parameterized queries/prepared statements and properly validating/neutralizing any user-controlled inputs that influence SQL SELECT statements. If vendor patches exist for mbCONNECT24/mymbCONNECT24, they should be applied; however, the supplied content does not include specific fixed version numbers or workaround steps. For detection, monitor the application endpoints associated with getProjectScalings for anomalous request patterns consistent with SQLi attempts (e.g., unexpected special characters or query-manipulation payload signatures), and review database logs for unusual SELECT query structures originating from the application service account.
poc_available: false
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-89