A blind SQL injection vulnerability in DwyerOmega Isensix ARMS 1.5.7 allows unauthenticated attackers to extract sensitive credentials and compromise system security.

The application is susceptible to blind SQL injection within the user parameter on the login page. This flaw allows an unauthenticated attacker to execute arbitrary database queries to exfiltrate sensitive data, including cleartext user and administrator credentials.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk due to the potential for unauthorized data access without prior authentication. Successful exploitation enables attackers to harvest account credentials, potentially leading to a full account takeover of administrative accounts, unauthorized access to sensitive monitoring data, and significant reputational damage to the organization.

Immediate Action: Contact the vendor or monitor the official DwyerOmega security portal for the release of a security patch addressing this SQL injection flaw.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for repeated attempts to inject SQL syntax into the login username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious input directed at the login endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists in the researcher's write-up (https://github.com/PilotPatrickk/Published-CVEs/blob/main/CVE-2025-59379.md).

Given the ability for an unauthenticated attacker to steal administrative credentials, this vulnerability poses a significant risk to the integrity of the monitoring environment. Organizations should prioritize the implementation of WAF rules to block exploitation attempts while awaiting a formal patch from the vendor. Once a security update is released, it must be applied immediately to eliminate the underlying injection vector.