CVE-2024-7201

Published Jul 29, 2024

Last updated 2 months ago

CVSS critical 9.8

Overview

Description: The login functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.
Source: twcert@cert.org.tw
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

twcert@cert.org.tw: CWE-89

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:simopro_technology:winmatrix3:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3E12AD4D-BB78-48B4-AF50-5A4E0109E4A6",
            "versionEndIncluding": "1.2.33.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References