Description
Mediconta 3.7.27 contains an unquoted service path vulnerability in the servermedicontservice that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\medicont3\ to inject malicious code that would execute with LocalSystem permissions during service startup.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Infonetsoftware | Mediconta | 3.7.27 | — |
References
- ExploitDB-51064 exploit
- Vendor Homepage product
- VulnCheck Advisory: Mediconta 3.7.27 - 'servermedicontservice' Unquoted Service Path third-party-advisory