This vulnerability involves improper neutralization of special elements in an SQL SELECT command within the getProjectTags function of mbCONNECT24. An unauthenticated attacker with low privileges can exploit this SQL Injection flaw remotely, potentially accessing or exfiltrating sensitive data. The CVSS 4.0 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Exploitation of this vulnerability can result in a total loss of confidentiality, meaning sensitive data accessible via the affected SQL query could be disclosed to unauthorized attackers. The vulnerability does not indicate impact on integrity or availability. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor MB connect line advisories for updates. Until a patch is available, restricting network access to the affected service and applying compensating controls to limit exposure may reduce risk.