Wondershare Dr.Fone Unquoted Service Path Vulnerability Allowing Arbitrary Code Execution

An unquoted service path vulnerability has been identified in Wondershare Dr.Fone version 11.4.9, specifically within the DFWSIDService. This vulnerability allows local users to execute arbitrary code by exploiting the unquoted path in the installation directory. Malicious executables can be injected and executed with LocalSystem privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of arbitrary code with elevated privileges.

Reproduction

The vulnerability can be reproduced by injecting a malicious executable into the unquoted service path of DFWSIDService. This executable will then be executed with LocalSystem privileges.