Event Log Explorer Unquoted Service Path Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in Event Log Explorer version 4.9.3, where an unquoted service path allows local users to execute arbitrary code with elevated privileges. This vulnerability can be exploited by placing malicious executables in certain file system locations, which will be executed with LocalSystem account privileges when the service starts.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of code with elevated system privileges.

Reproduction

The vulnerability can be reproduced by placing a malicious executable in a location that will be accessed by the 'ElodeaEventCollectorService' during startup. The service path can be verified using the Windows Management Instrumentation Command-line (WMIC) tool, which will show the unquoted path vulnerable to exploitation.