Sandboxie Plus 0.7.2 Unquoted Service Path ≈ Packet Storm – Digitalmunition




Exploit/Advisories no-image-featured-image.png

Published on March 11th, 2021 📆 | 6024 Views ⚑

0

Sandboxie Plus 0.7.2 Unquoted Service Path ≈ Packet Storm

Sandboxie Plus 0.7.2 Unquoted Service Path
Posted Mar 9, 2021
Authored by Mohammed Alshehri

Sandboxie Plus version 0.7.2 suffers from an unquoted service path vulnerability.

tags | exploit
MD5 | 8a7c9bdc588cf139ef26738c06a63266
# Exploit Title: Sandboxie Plus v0.7.2 - 'SbieSvc' Unquoted Service Path
# Date: 2021-1-20
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: sandboxie-plus.com
# Software Link: https://github.com/sandboxie-plus/Sandboxie/releases/download/0.7.2/Sandboxie-Plus-x64-v0.7.2.exe
# Version: Version 0.7.2
# Tested on: Microsoft Windows 10 Education - 10.0.17763 N/A Build 17763

# Service info:
C:Usersm507>sc qc SbieSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SbieSvc
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:Program FilesSandboxie-PlusSbieSvc.exe
LOAD_ORDER_GROUP : UIGroup
TAG : 0
DISPLAY_NAME : Sandboxie Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:Usersm507>

# Exploit:
This vulnerability could permit executing code during startup or reboot with the escalated privileges.

Source link

Tagged with:



Leave a Reply