Administrator access via client-side authorization bypass

Privilege escalation in Softwarebüro Zauner ZA|ARC 4.2.0.4 allows local users to gain application administrator access. ZA|ARC checks login results and privilege levels only in the client, while every client connects to the database through the same technical account. Local access to the client process permits a debugger or binary patch to force a successful password result for any valid username and take direct control of database queries.