This vulnerability is an SQL Injection (CWE-89) in mbCONNECT24, specifically in the UpdateParam function of the admin.mbnetj.php file. Due to improper neutralization of special elements in an SQL UPDATE command, an unauthenticated attacker with high privileges can exploit this flaw to read the entire database and alter data in a non-critical table. The impact includes total loss of confidentiality and some loss of data integrity. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality with limited impact on integrity. No patch or official remediation level has been published by the vendor as of the data provided.

An attacker exploiting this vulnerability can gain unauthorized read access to the entire database and modify data in a non-critical table. This results in a total loss of confidentiality of the database contents and partial loss of data integrity. The vulnerability requires high privileges but no authentication or user interaction is needed. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the vulnerable admin.mbnetj.php interface and applying compensating controls to limit exposure may reduce risk.