A vulnerability in Softalk WorkgroupMail 7.5.1 allows local attackers to achieve privilege escalation by exploiting an unquoted service path configuration.

This flaw involves an unquoted Windows service binary path that allows an attacker with local access to place a malicious executable in a parent directory, which the system will execute with elevated LocalSystem privileges. The vulnerability does not require initial authentication beyond local access to the file system.

The exploitation of this vulnerability leads to full system compromise due to the elevated privileges of the affected service. Successful attackers can gain control over the host operating system, potentially leading to data exfiltration, lateral movement within the network, or the installation of persistent backdoors. While the CVSS score of 7.8 reflects a High severity, the impact of achieving LocalSystem execution is critical for any enterprise environment.

Immediate Action: Administrators should update to a patched version of WorkgroupMail if available, or manually modify the Windows service configuration to include quotes around the binary path (e.g., changing the path to "C:\Program Files (x86)\WorkgroupMail\wmsvc.exe" -s).

Proactive Monitoring: Monitor Windows Event Logs for unusual service creation events or unexpected binary executions originating from the WorkgroupMail installation directory.

Compensating Controls: Ensure strict file system permissions are applied to the installation directory to prevent unauthorized users from writing or modifying files within the path of the service binary.

Public Exploit Available: Yes, a local exploit proof-of-concept exists as documented in the Exploit Database (EDB-ID 47523).

Given the potential for complete system takeover, organizations running Softalk WorkgroupMail must prioritize the remediation of this unquoted service path. Immediate manual intervention to correct the service configuration is necessary if an official patch has not been deployed, as local privilege escalation vulnerabilities remain a primary target for attackers seeking to establish persistence and control within a compromised environment.