Simopro Technology WinMatrix3 Web Package SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the WinMatrix3 Web package by Simopro Technology, affecting versions through 1.2.38.1. This vulnerability allows unauthenticated remote attackers to inject arbitrary SQL commands, potentially leading to unauthorized reading, modification, or deletion of database contents.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to manipulate the application's database. This could result in unauthorized data access, data modification, or data deletion.

Remediation

Users are advised to update to WinMatrix Web version 1.2.39.5 or later, and to install the available hotfix. Alternatively, users can update to version 1.3.1 or later.