CVE-2025-4738: SQL Injection in MY ERP

Successful exploitation of CVE-2025-4738 could allow an attacker to bypass authentication mechanisms and directly manipulate the database. This could lead to the exfiltration of confidential data, including customer information, financial records, and proprietary business data. Furthermore, an attacker could potentially modify or delete data, disrupt operations, or even gain control of the underlying server. The blast radius extends to any data stored within the MY ERP database, making this a high-severity risk. While no direct precedent is immediately obvious, SQL Injection vulnerabilities are consistently among the most exploited, often leading to significant data breaches and regulatory penalties.

1. Reserved2025-05-15
2. Published2025-06-19
3. Modified2025-06-20
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-4738 is to immediately upgrade MY ERP to version 1.170 or later, which contains the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds such as input validation and parameterized queries within the application code. Web application firewalls (WAFs) configured with rules to detect and block SQL Injection attempts can provide an additional layer of defense. Monitor database logs for suspicious SQL queries that might indicate an ongoing attack. After upgrading, confirm the vulnerability is resolved by attempting a SQL Injection attack on a non-critical endpoint and verifying that the input is properly sanitized.