CVE-2024-7202 CRITICAL

CVE-2024-7202: Simopro Technology WinMatrix3 Web package - SQL Injection

Vendor Simopro Technology
Product WinMatrix3
Weakness CWE-89 · SQLi
Published July 29, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The query functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.

Key dates

02Disclosure timeline

July 29, 2024 CVE published
August 1, 2024 Record updated