by Kastro
Paper/Archive/CVE-2024-7202

CVE-2024-7202

Simopro Technology WinMatrix3 — Simopro Technology WinMatrix3 Web package - SQL Injection

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.6.526 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The query functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.

Affected

ProductAffectedFixed inSource
WinMatrix3≤ 1.2.35.3–CNA
winmatrix3≤ 1.2.35.3–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorytwcert.org.tw/tw/cp-132-7962-dd216-1.htmladvisorytwcert.org.tw/en/cp-139-7963-44648-2.html