This vulnerability involves an SQL Injection (CWE-89) in the _RemoveRequest function of mbCONNECT24. Due to improper neutralization of special elements in a SQL DELETE command, a high privileged remote attacker can execute unauthorized SQL commands without authentication. The attacker can read the entire database and delete entries in a non-critical table. The CVSS 4.0 score is 7.0, indicating high severity, with network attack vector, low attack complexity, no user interaction, and high confidentiality impact but limited integrity impact.

Exploitation of this vulnerability can lead to a total loss of confidentiality as the attacker can read the entire database. There is also some loss of integrity due to the ability to delete entries in a non-critical table. No information about availability impact is provided. The vulnerability requires high privileges but no user interaction or authentication, making it a significant risk in environments where high privileged access is possible remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Until a patch is available, restrict high privileged remote access to the affected mbCONNECT24 system and monitor for unusual database activity related to the _RemoveRequest function.