MB connect line mbCONNECT24 anfällig für eine nicht authentifizierte (SQL Injection) in dem setinfo Endpoint

The SQL Injection vulnerability in mbCONNECT24 poses a significant threat due to its unauthenticated nature and potential for widespread impact. An attacker can exploit this flaw to bypass authentication and directly manipulate the database. This could lead to unauthorized access to sensitive data, including user credentials, configuration information, and potentially even financial records. The description explicitly states a 'total loss of integrity and availability' is possible, indicating the potential for data corruption, denial of service, and complete system compromise. Successful exploitation could mirror the impact seen in other SQL Injection attacks targeting similar database-driven applications, allowing attackers to gain full control of the affected system.

Organizations utilizing mbCONNECT24 in production environments, particularly those with publicly accessible instances, are at significant risk. This includes businesses relying on mbCONNECT24 for communication or data management, especially those with inadequate security controls or outdated configurations. Shared hosting environments where multiple users share the same mbCONNECT24 instance are also particularly vulnerable.

• generic web: Use curl to test the setinfo endpoint with various SQL injection payloads. Check for error messages or unexpected behavior indicating successful injection.

curl -X POST -d "param='; DROP TABLE users;--" http://your-mbconnect24-server/setinfo

• database (mysql): If you have access to the database, review the mbCONNECT24 database logs for suspicious SQL queries or attempts to access sensitive data. • linux / server: Monitor system logs (e.g., /var/log/auth.log, /var/log/syslog) for unusual activity related to the mbCONNECT24 service or database connections.

1. 2026-04-02Disclosure

   disclosure

1. Reserviert2026-03-23
2. Veröffentlicht2026-04-02
3. EPSS aktualisiert2026-04-09

The primary mitigation for CVE-2026-33615 is to upgrade mbCONNECT24 to a patched version as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds to reduce the attack surface. These may include restricting access to the setinfo endpoint to trusted networks or users, implementing strict input validation on all parameters passed to the endpoint, and enabling Web Application Firewall (WAF) rules to detect and block SQL Injection attempts. Monitor system logs for suspicious activity, particularly SQL errors or unusual database queries. After upgrading, verify the fix by attempting a SQL Injection attack on the setinfo endpoint using a benign payload to confirm that the vulnerability has been successfully remediated.