Easy-Hide-IP Unquoted Service Path Vulnerability in EasyRedirect Allowing Privilege Escalation

A vulnerability exists in Easy-Hide-IP version 5.0.0.3 within the EasyRedirect service, where an unquoted service path could allow local attackers to execute arbitrary code. The flaw arises because the service path in 'C:\Program Files\Easy-Hide-IP\rdr\EasyRedirect.exe' is unquoted, enabling the injection of malicious executables that could be executed with elevated privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of code with elevated privileges on the affected system.

Reproduction

The vulnerability can be reproduced by exploiting the unquoted service path. After injecting a malicious executable into the path, the EasyRedirect service can be started, executing the injected code with elevated privileges.