Cain and Abel Unquoted Service Path Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in Cain & Abel version 4.9.56 due to an unquoted service path. This flaw allows local attackers to execute arbitrary code with elevated privileges. Exploitation involves injecting malicious executables into the unquoted binary path, which are then executed with LocalSystem permissions.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of arbitrary code with elevated privileges, allowing local attackers to gain higher access rights and potentially manipulate system functions or data.

Reproduction

The vulnerability can be reproduced by creating a service with an unquoted path that includes spaces. Once the service is started, any executable placed in the path can be executed with LocalSystem privileges.