[Vulnerability Alert] SQL Injection Vulnerability in Dayang Technology's WinMatrix3 Web Suite

Date Posted: 2025/07/30

Subject: [Vulnerability Alert] SQL Injection Vulnerability in Dayang Technology's WinMatrix3 Web Suite

Content:
- Forwarded from Taiwan Computer Network Emergency Response Team/Coordination Center TWCERTCC-200-202507-00000016
- [Dayang Technology | WinMatrix3 Web Suite - SQL Injection] (CVE-2025-7918, CVSS: 9.8) A SQL Injection vulnerability exists in the WinMatrix3 Web suite developed by Dayang Technology. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database content.
Affected Platforms:
- WinMatrix Web versions 1.2.39.5 (inclusive) and earlier
Recommended Action:
- Update AP to 3.852.5 (Web 1.2.39.5) and install the hotfix, or update AP to AP version 3.9.1 (Web 1.3.1) (inclusive) and later.
References:
- https://www.twcert.org.tw/tw/cp-132-10259-b4b38-1.html

Computer and Communications Center
Network Systems Group