This vulnerability involves an unauthenticated SQL Injection in the userinfo endpoint of mbCONNECT24, caused by improper neutralization of special elements in a SQL SELECT command. An attacker can remotely exploit this without authentication, potentially extracting sensitive data from the backend database. The CVSS 4.0 base score is 8.7, reflecting high impact and ease of exploitation with no privileges or user interaction required. No patch or official remediation guidance has been published by the vendor yet.

An attacker exploiting this vulnerability can achieve a total loss of confidentiality by executing arbitrary SQL commands on the backend database. This could lead to unauthorized disclosure of sensitive information stored within the mbCONNECT24 system. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected userinfo endpoint and monitor for unusual activity. Avoid exposing the vulnerable service to untrusted networks where possible.