Dwyer Isensix Advanced Remote Monitoring System Blind SQL Injection Vulnerability

A blind SQL injection vulnerability has been identified in Dwyer Isensix Advanced Remote Monitoring System (ARMS) version 1.5.7 and earlier. This vulnerability allows attackers to retrieve sensitive information from the underlying SQL database by exploiting the user parameter on the login page. As a result, attackers can access and steal credentials, including those of admin users, which can then be used to authenticate to the application.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the application with admin privileges, allowing the attacker to perform administrative functions.