轉發 台灣電腦網路危機處理暨協調中心 TWCERTCC-200-202507-00000016

[內容說明]
【達煬科技｜WinMatrix3 Web套件 - SQL Injection】(CVE-2025-7918，CVSS：9.8) 達煬科技開發之WinMatrix3 Web套件存在SQL Injection漏洞，未經身分鑑別之遠端攻擊者可注入任意SQL指令讀取、修改及刪除資料庫內容。

[影響平台]
● WinMatrix Web 1.2.39.5(含)以前版本

[建議措施]
更新AP至3.852.5(Web 1.2.39.5)並安裝hotfix，或更新AP至3.9.1(Web 1.3.1)(含)以後版本

[參考資料]
https://www.twcert.org.tw/tw/cp-132-10259-b4b38-1.html

Forwarded by Taiwan Computer Network Crisis Management and Coordination Center TWCERTCC-200-202507-00000016

[Content Description]
[Simopro｜WinMatrix3 Web Suite - SQL Injection] (CVE-2025-7918, CVSS: 9.8) The WinMatrix3 Web Suite developed by Simopro has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

[Affected Platforms]
● WinMatrix Web 1.2.39.5 (inclusive) and earlier versions

[Recommended Measures]
Update AP to 3.852.5 (Web 1.2.39.5) and install hotfix, or update AP to 3.9.1 (Web 1.3.1) (inclusive) and later versions

[References]
https://www.twcert.org.tw/tw/cp-132-10259-b4b38-1.html