A local privilege escalation vulnerability in BlackMoon FTP Server 3.1.2.1731 allows unprivileged users to execute code with elevated system permissions.

The application utilizes an unquoted service path for the BMFTP-RELEASE service. Local, authenticated users can exploit this by placing a malicious binary in the path, which the service will execute with LocalSystem account privileges during startup.

Successful exploitation of this vulnerability results in full system compromise, as the attacker gains the highest level of execution privileges on the host machine. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to unauthorized data access, the installation of persistent backdoors, or complete operational disruption of the affected server.

Immediate Action: Since no official patch is available, administrators should manually correct the service path by adding quotes to the binary path configuration in the Windows Registry or via the sc config command to ensure the system interprets the path correctly.

Proactive Monitoring: Review Windows System Event logs for service startup failures or unexpected binary executions originating from the application installation directory.

Compensating Controls: Implement strict file system permissions on the installation directory to prevent non-administrative users from writing or modifying files within the application path.

Public Exploit Available: Yes, a local exploit is documented in the Exploit Database (EDB-ID: 47521).

The risk posed by this vulnerability is significant due to the potential for full system compromise. Organizations running BlackMoon FTP Server 3.1.2.1731 must prioritize the manual remediation of the unquoted service path. If the software cannot be secured or updated, it should be decommissioned and replaced with a supported alternative to mitigate the risk of local privilege escalation.