by Kastro
Paper/Archive/CVE-2024-7201

CVE-2024-7201

Simopro Technology WinMatrix3 — Simopro Technology WinMatrix3 Web package - SQL Injection

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.6.526 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The login functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.

Affected

ProductAffectedFixed inSource
WinMatrix3≤ 1.2.33.3–CNA
winmatrix3≤ 1.2.33.3–CISA-ADP

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorytwcert.org.tw/tw/cp-132-7960-0ee18-1.htmladvisorytwcert.org.tw/en/cp-139-7961-c575f-2.html