The Ofek Nakar Virtual Bot product (versions <= 1.0.0) contains an SQL Injection vulnerability (CVE-2025-22542) caused by improper neutralization of special elements in SQL commands. This allows an attacker to conduct Blind SQL Injection attacks remotely without authentication or user interaction. The vulnerability has a CVSS v3.1 base score of 9.3, reflecting critical impact with high confidentiality impact and limited availability impact. No official patch or remediation guidance has been provided yet, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the backend database (high confidentiality impact). The integrity of data is not directly impacted, but availability may be slightly affected (low impact). The vulnerability can be exploited remotely without authentication, increasing the risk of compromise. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and monitor for unusual database activity. Avoid exposing the vulnerable version to untrusted networks. Do not assume the vulnerability is mitigated without vendor confirmation.