CVE-2024-7202 is a critical severity (CVSS 9.8) SQL injection in the WinMatrix3 Web package from Simopro Technology. The query function does not validate input, so an unauthenticated remote attacker can read, change, and delete database contents. Update to version 1.2.35.3 or later.
What's affected
According to the TWCERT/CC Taiwan Vulnerability Note TVN-202407013, the affected product is the WinMatrix3 Web package, version 1.2.33.3 and earlier. The note names 1.2.35.3 or later as the fixed release.
The NVD record lists the product as WinMatrix3 from Simopro Technology without version bounds, so the TWCERT/CC note is the source for the version range. There is no conflict on severity: NVD and TWCERT/CC both give 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
That vector reads plainly. The attack comes over the network, needs no special conditions, no account, and no user interaction, and the impact on confidentiality, integrity, and availability is rated high on all three.
The weakness is CWE-89, improper neutralization of special elements used in an SQL command. The record does not mark this CVE as exploited in the wild (it is not in CISA's Known Exploited Vulnerabilities catalog), and the advisory does not say it is being exploited.
How to check if you're exposed
The advisory gives no detection commands, so the check is an inventory exercise.
- Find every host that runs the WinMatrix3 Web package. It is a web application, so look at web servers and application inventories rather than package manager output.
- Read the installed version from the product's own about page or installer record, or ask the team that administers it.
- Compare it with the advisory. Anything at 1.2.33.3 or earlier is affected. Anything at 1.2.35.3 or later has the fix.
- Note whether the web interface is reachable from the internet or from broad internal networks. Because no authentication is needed, reachability decides how urgent this is.
If you cannot confirm the version, treat the instance as affected until Simopro or your integrator confirms otherwise. Check the TWCERT/CC note and the vendor for anything newer than what is described here.
What to do now
- Update the WinMatrix3 Web package to 1.2.35.3 or later, following the vendor's upgrade instructions.
- Until the update is done, restrict access to the web interface to trusted networks, and take it off the internet if it is exposed.
- Review database and web server logs for unusual queries or errors from the period before you patched. The advisory does not describe indicators, so this is general hygiene and not a confirmed signature.
- Make sure the database account the application uses has only the permissions it needs. This does not fix the flaw, but it limits what a successful injection can do.
- Back up the database before and after the update so you can compare and restore if you find tampering.
Why it matters
SQL injection happens when user input is placed into a database query without being kept separate from the query itself. The database cannot tell data from commands, so a crafted value can change what the query does. The standard fixes are parameterized queries and strict input validation on the server.
What raises the severity here is the combination of no login and full read, write, and delete access. A query feature is often exposed so users can search records, which makes it easy to reach. For an application that holds business data, the risk covers both leaking records and silently altering them.
Packaged web applications like this are easy to lose track of. They often sit outside the usual dependency manifests, so they miss the scans that cover your own code. Safeguard's free in-browser dependency scan covers the open source packages in your projects, and the Gold directory helps you look up a CVE like this one. Reachability analysis helps you decide which findings in your own code matter first.
Quick check
Does an attacker need an account to use CVE-2024-7202?
No. The advisory describes the attacker as unauthenticated, and the CVSS vector shows no privileges and no user interaction required.
Which version fixes it?
TWCERT/CC says to update WinMatrix3 Web package to 1.2.35.3 or later. Versions 1.2.33.3 and earlier are listed as affected.
Sources
Last reviewed: 19 October 2026.
