Description
iFunbox 4.2 contains an unquoted service path vulnerability in the Apple Mobile Device Service that allows local attackers to execute code with elevated privileges. Attackers can insert a malicious executable into the unquoted service path to run with LocalSystem privileges when the service restarts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| I-Funbox | iFunbox | 4.2 | — |
References
- ExploitDB-50040 exploit
- iFunbox Official Homepage product
- VulnCheck Advisory: iFunbox 4.2 - 'Apple Mobile Device Service' Unquoted Service Path third-party-advisory