An unauthenticated SQL Injection vulnerability exists in mbCONNECT24's dash.php saveDashboardLayout function due to improper neutralization of special elements in an SQL INSERT command. This flaw allows a low privileged remote attacker to read the entire database and insert data into a non-critical table. The vulnerability impacts confidentiality fully and integrity partially. The CVSS 4.0 base score is 7.1 (high severity), with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official patch or remediation level has been published, and the product is not cloud-hosted.

Exploitation of this vulnerability can lead to a total loss of confidentiality by allowing an attacker to read the entire database contents. Additionally, the attacker can insert entries into a non-critical table, causing some loss of data integrity. There is no indication of impact on availability or other security properties. The vulnerability is exploitable remotely without authentication and requires low privileges, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor MB connect line advisories for updates. Until a patch is available, restricting access to the affected dash.php functionality and applying network-level controls to limit exposure may reduce risk. Avoid exposing the vulnerable interface to untrusted networks.