A local privilege escalation vulnerability in Sandboxie Plus 0.7.2 allows attackers to execute code as LocalSystem by exploiting an unquoted service path.

This is an unquoted service path vulnerability (CWE-428) located in the SbieSvc service. An attacker with local access can place a malicious executable in the path of the service, which the system will then execute with elevated LocalSystem permissions during service startup.

The ability for a local user to gain LocalSystem privileges represents a complete compromise of the affected host. This severity, reflected by a CVSS score of 7.8, indicates that an attacker could bypass all standard user restrictions, install persistent backdoors, or exfiltrate sensitive data from the machine.

Immediate Action: Update to a version of Sandboxie Plus later than 0.7.2, as this specific release is confirmed to be vulnerable.

Proactive Monitoring: Monitor system logs for unauthorized service modifications or the creation of suspicious executables in the C:\Program Files\ directory tree.

Compensating Controls: Ensure that directory permissions for the installation path of Sandboxie Plus are strictly limited to prevent non-privileged users from creating or modifying files within the application folder.

Public Exploit Available: Yes, a proof-of-concept exists as documented in ExploitDB entry 49631.

Given the ease with which an attacker can escalate privileges from a standard user to LocalSystem, this vulnerability poses a significant risk to environment integrity. Administrators should prioritize updating the Sandboxie Plus software immediately to remediate the unquoted service path, as the existence of a public proof-of-concept significantly lowers the barrier for potential exploitation.