vendor:
PDFCOMPLETE Corporate Edition
by:
Ismael Nava
7.8
CVSS
HIGH
Unquoted Service Path
749
CWE
Product Name: PDFCOMPLETE Corporate Edition
Affected Version From: 4.1.45
Affected Version To: 4.1.45
Patch Exists: NO
Related CWE: N/A
CPE: a:pdf_complete:pdf_complete_corporate_edition:4.1.45
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Windows 10 64 bits
2020
PDFCOMPLETE Corporate Edition 4.1.45 – ‘pdfcDispatcher’ Unquoted Service Path
The PDFCOMPLETE Corporate Edition 4.1.45 is vulnerable to an unquoted service path vulnerability. This vulnerability can be exploited by an attacker to gain elevated privileges on the system. The vulnerability exists due to the pdfcDispatcher service not being properly quoted. An attacker can exploit this vulnerability by creating a malicious executable with the same name as the service and placing it in the same directory as the service executable. The malicious executable will then be executed with elevated privileges.
Mitigation:
The best way to mitigate this vulnerability is to ensure that all services are properly quoted. Additionally, administrators should ensure that all services are running with the least privileges necessary.
