Authenticated SQLi in Yirmibes Software's MY ERP

Successful exploitation of CVE-2025-4738 could allow an attacker to bypass authentication mechanisms and directly manipulate the database. This could lead to the exfiltration of confidential data, including customer information, financial records, and proprietary business data. Furthermore, an attacker could potentially modify or delete data, disrupt operations, or even gain control of the underlying server. The blast radius extends to any data stored within the MY ERP database, making this a high-severity risk. While no direct precedent is immediately obvious, SQL Injection vulnerabilities are consistently among the most exploited, often leading to significant data breaches and regulatory penalties.

Organizations heavily reliant on MY ERP for core business processes, particularly those handling sensitive customer data or financial information, are at significant risk. Companies with legacy MY ERP deployments or those lacking robust security monitoring practices are especially vulnerable.

• other / database: Use native CLI queries to check for SQL injection vulnerabilities.

-- SQL Injection test query
SELECT 'test' FROM users WHERE username = 'admin' OR '1'='1';

• generic web: Check for unusual SQL errors in web application logs. Look for patterns like 'syntax error' or 'invalid column name' that might indicate an attempted SQL Injection. • generic web: Monitor access logs for requests containing suspicious characters commonly used in SQL Injection attacks (e.g., ', ", --, /*, */).

1. 2025-06-19Disclosure

   disclosure

1. Reserviert2025-05-15
2. Veröffentlicht2025-06-19
3. Geändert2025-06-20
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-4738 is to immediately upgrade MY ERP to version 1.170 or later, which contains the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds such as input validation and parameterized queries within the application code. Web application firewalls (WAFs) configured with rules to detect and block SQL Injection attempts can provide an additional layer of defense. Monitor database logs for suspicious SQL queries that might indicate an ongoing attack. After upgrading, confirm the vulnerability is resolved by attempting a SQL Injection attack on a non-critical endpoint and verifying that the input is properly sanitized.