CVE-2024-7201
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The login functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Simopro Technology | WinMatrix3 | 0 <= 1.2.33.3 | affected |
Weaknesses
- CWE-89: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
CVE Program Container
Additional References
- https://www.twcert.org.tw/tw/cp-132-7960-0ee18-1.html
- https://www.twcert.org.tw/en/cp-139-7961-c575f-2.html
References
- https://www.twcert.org.tw/tw/cp-132-7960-0ee18-1.html
- https://www.twcert.org.tw/en/cp-139-7961-c575f-2.html
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.