An unauthenticated blind SQL injection vulnerability in MB connect line products poses a high risk of total confidentiality loss due to potential unauthorized database access.

The application is susceptible to a blind SQL injection attack (CWE-89) within the mb24api endpoint. This vulnerability allows an unauthenticated remote attacker to manipulate SQL SELECT commands, potentially leading to the full disclosure of sensitive database information.

Successful exploitation of this vulnerability permits unauthorized access to backend database contents, resulting in a total loss of confidentiality. With a CVSS score of 7.5, this high-severity flaw represents a significant risk to data privacy and regulatory compliance, as the attack requires no authentication and can be executed remotely over a network.

Immediate Action: Consult the official vendor advisory provided by CERT VDE for available patches or configuration updates. If a patch is not yet available, restrict network access to the affected mb24api endpoint to trusted sources only.

Proactive Monitoring: Review database audit logs for anomalous query patterns, specifically looking for unexpected syntax elements or high volumes of requests directed at the mb24api interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection payloads targeting API endpoints.

Public Exploit Available: No (exploit_available: false)

Given the potential for total loss of confidentiality and the high CVSS score, organizations using the affected MB connect line products must prioritize this advisory. Administrators should immediately restrict access to the vulnerable API endpoint and monitor vendor channels for the release of a corrective patch, ensuring it is applied as soon as it becomes available to prevent potential data exfiltration.