A local unquoted service path vulnerability in Disk Sorter Server 13.6.12 enables attackers to achieve unauthorized privilege escalation and arbitrary code execution.

The application utilizes an unquoted service path for the binary at C:\Program Files\Disk Sorter Server\bin\disksrs.exe. This misconfiguration allows a local user with sufficient filesystem permissions to place a malicious executable in the path, which the service will then execute with LocalSystem privileges.

The exploitation of this vulnerability results in full system compromise, as it allows a low-privileged local user to escalate their permissions to LocalSystem. With a CVSS score of 7.8, this represents a significant risk to the integrity and availability of the affected server, potentially leading to unauthorized data access, the installation of persistent backdoors, or complete system takeover.

Immediate Action: Since no official patch is currently identified, administrators should manually modify the service path configuration in the Windows Registry to wrap the binary path in double quotes.

Proactive Monitoring: Review system logs for unexpected service restarts or the creation of unauthorized executable files within the C:\Program Files\Disk Sorter Server\ directory.

Compensating Controls: Implement strict filesystem permissions on the installation directory to prevent non-administrative users from writing or modifying files within the application path.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit Database (EDB-ID: 50013).

Given the availability of a public proof-of-concept and the high potential for privilege escalation, administrators must prioritize securing the service path. While waiting for a formal vendor update, manual configuration of the service path in the Windows Registry is the necessary step to neutralize this attack vector and prevent unauthorized escalation.