Mediconta Unquoted Service Path Vulnerability in Servermedicontservice Allowing Privilege Escalation

A vulnerability exists in Mediconta version 3.7.27 within the 'servermedicontservice' due to an unquoted service path. This flaw enables local users to execute code with elevated privileges. The unquoted path in 'C:\Program Files (x86)\medicont3\' can be exploited to inject malicious code that executes with LocalSystem rights when the service starts.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution with elevated privileges, allowing a local user to execute malicious payloads as the LocalSystem user.

Reproduction

The vulnerability can be reproduced by exploiting the unquoted service path of 'servermedicontservice'. A local user must place malicious code in a location that can be executed during the service startup, undetected by the operating system or security applications. Once the service is triggered to start, the injected code will execute with elevated privileges.