This vulnerability is an unauthenticated SQL Injection in the DeleteSysLogEntry function of mbCONNECT24, caused by improper neutralization of special elements in a SQL DELETE command. A high privileged remote attacker can exploit this to read the entire database and delete entries in a non-critical table. The vulnerability impacts confidentiality fully and integrity partially. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality with limited impact on integrity. No official fix or patch is currently documented.

Exploitation of this vulnerability can result in a total loss of confidentiality of the database contents and some loss of integrity due to deletion of entries in a non-critical table. This means sensitive data could be exposed and some database records could be altered or removed, although critical tables are not affected. The attacker requires high privileges but no authentication or user interaction is needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected function and monitor for suspicious activity related to SQL commands targeting the DeleteSysLogEntry function. Avoid exposing the vulnerable interface to untrusted networks if possible.