Simopro Technology WinMatrix3 Web Package SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the WinMatrix3 Web package by Simopro Technology, affecting versions through 1.2.38.1. This vulnerability allows unauthenticated remote attackers to inject arbitrary SQL commands, potentially leading to unauthorized reading, modification, or deletion of database contents.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to manipulate database queries. This could result in unauthorized access to, or modification of, database information, including the deletion of data.

Remediation

Users are advised to update to version 3.8.52.5 (Web 1.2.39.5) and install the hotfix, or to version 3.9.1 (Web 1.3.1) or later.