This vulnerability (CVE-2025-4738) affects Yirmibes Software MY ERP prior to version 1.170 and is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It allows remote attackers to inject malicious SQL commands due to insufficient input sanitization. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation of this SQL Injection vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data disclosure, data modification, or deletion, and potentially full system compromise. The vulnerability affects all versions of MY ERP before 1.170. There are no known exploits in the wild at this time.

No official patch or remediation has been published by Yirmibes Software as of the current information. Users should monitor the vendor's advisories for updates and apply the official fix once available. Until then, consider implementing web application firewalls or input validation controls as temporary mitigations, but these do not replace an official patch. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.