The vulnerability is an unauthenticated blind SQL injection in the mb24api endpoint of MB connect line products, allowing a remote attacker to retrieve arbitrary data from the database. Because the injection occurs without authentication, any user can exploit it, potentially exposing all information stored within the system. The weakness corresponds to CWE-89 and results in a complete loss of confidentiality, as attacker‑controlled queries can return sensitive content.

Products affected are mbCONNECT24 and mymbCONNECT24 from MB connect line. Version information was not disclosed in the advisory, so administrators should verify whether their current installations encompass the vulnerable code base. The defect resides in the mb24api component responsible for handling external API calls.

The CVSS score of 7.5 indicates a high severity vulnerability with significant impact on confidentiality. EPSS data is not available, but the absence of the vulnerability from KEV catalog suggests no widely known active exploits yet; however, the blind nature of the injection and lack of authentication requirements increase its attractiveness to attackers. Exploitation would involve sending crafted input to the mb24api endpoint over the network, bypassing any standard authentication mechanism, and then reading the returned data, which could contain sensitive business information.