Exploitation Summary
EIP tracks 1 public exploit for CVE-2020-37160. PoCs published by boku.
AI-analyzed exploit summary This exploit demonstrates a local privilege escalation (LPE) in SprintWork 2.3.1 by leveraging insecure file permissions and a missing executable for the 'SP52 AMC' service. A low-privileged user can place a malicious binary in the service directory, which executes as LocalSystem upon reboot.
Description
SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local unprivileged users can exploit missing executable files and weak service configurations to create a new administrative user and gain complete system access.
Exploits (1)
This exploit demonstrates a local privilege escalation (LPE) in SprintWork 2.3.1 by leveraging insecure file permissions and a missing executable for the 'SP52 AMC' service. A low-privileged user can place a malicious binary in the service directory, which executes as LocalSystem upon reboot.
References (4)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N