LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious "cmd.exe" in the folder of the vulnerable LiveCode application. If the application is using LiveCode's "shell()" function, it will attempt to search for "cmd.exe" in the folder of the current application and run the malicious "cmd.exe".
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
| Link | Tags |
|---|---|
| https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/ | third party advisory exploit |
| https://quality.livecode.com/show_bug.cgi?id=22942 | third party advisory |
| https://github.com/livecode/livecode/pull/7454 | vendor advisory |