An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an unauthenticated SQL injection in DATA24, allowing attackers to discover database and table names.
References
Link | Resource |
---|---|
https://mbconnectline.com/security-advice/ | Patch Vendor Advisory |
https://mbconnectline.com/security-advice/ | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 04:55
Type | Values Removed | Values Added |
---|---|---|
References | () https://mbconnectline.com/security-advice/ - Patch, Vendor Advisory |
Information
Published : 2020-04-14 17:15
Updated : 2024-11-21 04:55
NVD link : CVE-2020-10381
Mitre link : CVE-2020-10381
CVE.ORG link : CVE-2020-10381
JSON object : View
Products Affected
mbconnectline
- mbconnect24
- mymbconnect24
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')