KMSpico Unquoted Service Path Vulnerability in Service KMSELDI Allowing Privilege Escalation

A vulnerability exists in KMSpico version 17.1.0.0 within the Service KMSELDI configuration, where an unquoted service path could allow local attackers to execute arbitrary code. The flaw arises because the binary path in 'C:\Program Files\KMSpico\Service_KMS.exe' is unquoted, enabling the injection of malicious executables that could be executed with elevated privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of code with elevated privileges on the affected system.

Reproduction

The vulnerability can be reproduced by exploiting the unquoted service path of the 'Service KMSELDI' Windows service. This can be done by injecting a malicious executable into the path where the service binary is located. Once the executable is injected, the service can be started, executing the injected code with elevated privileges.