A local privilege escalation vulnerability in MilleGPG5 5.7.2 allows authenticated users to achieve system level execution privileges.

The software exhibits a weakness in file permissions (CWE-276) where the Authenticated Users group possesses modify permissions on the service directories. This allows a local authenticated user to replace legitimate binaries, such as mysqld.exe, with malicious executables that run with NT AUTHORITY\SYSTEM privileges upon system restart.

The ability for a low privilege user to escalate to system level privileges poses a severe risk to organizational security. Successful exploitation could lead to full system compromise, unauthorized data access, and the potential for lateral movement across the network. With a CVSS score of 7.8, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized administrative control.

Immediate Action: Upgrade to the latest version of MilleGPG5 provided by the vendor to remediate the insecure folder permissions. If an update is unavailable, manually restrict folder permissions for the MilleGPG5 directory to remove modify access for non-administrative users.

Proactive Monitoring: Review system logs for unexpected service restarts or modifications to files within the installation directory. Monitor for unauthorized creation or execution of files within the MariaDB bin folder.

Compensating Controls: Implement strict Application Whitelisting policies to prevent the execution of unauthorized binaries. Ensure that Principle of Least Privilege is enforced for all local user accounts on the host system.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in an ExploitDB entry.

Given the ease of exploitation and the critical impact of achieving system level privileges, administrators should prioritize the remediation of this vulnerability. Applying the vendor provided update or manually enforcing secure NTFS permissions is essential to prevent local attackers from escalating their privileges and gaining full control over the affected Windows host.