Description
OCS Inventory NG 2.3.0.0 contains an unquoted service path vulnerability that allows local attackers to escalate privileges to system level. Attackers can place a malicious executable in the unquoted service path and trigger the service restart to execute code with elevated system privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| oscinventory | OCS Inventory NG | ≤ 2.3.0.0 | — |
References
- ExploitDB-51389 exploit
- Official Product Homepage product
- VulnCheck Advisory: OCS Inventory NG 2.3.0.0 Unquoted Service Path Privilege Escalation third-party-advisory