The vulnerability is a classic SQL injection flaw. Based on the description, it is inferred that an attacker with either no authentication or only limited privileges can inject malicious SQL statements into the InfoScale VIOM web application. By manipulating input parameters, the attacker can gain higher privileges than intended through the application’s database interactions. This flaw falls under the standard SQL injection weakness.

Systems running InfoScale VIOM before version 9.1.3 are affected. The vulnerability is present in the web application interface that typically accepts user-supplied data without proper sanitization. Admins and service accounts that interact with the affected components are at risk of unintended privilege escalation.

The flaw carries a high risk because it permits privilege escalation without requiring local access. The attack vector is inferred to be remote via the web interface, as the description states "remote attackers". The CVSS score of 6.5 indicates moderate severity, but the consequence is still severe. The EPSS score is not provided and the issue is not listed in KEV, so immediate attention is still warranted based on the verified remote exploitation potential.