CVE-2025-57392

CVE-2025-57392

🔒 Security Vulnerability Report Product: BenimPOS Desktop V3.0 Vulnerability Type: Insecure File Permissions Affected Components: BenimPOS.exe, unins000.exe, System.Data.SQLite.dll Vulnerability Class: CWE-276: Incorrect Default Permissions Proof of Concept by: Fatih Bülbül Test Environment: Windows 11 x64 – Local Admin + Standard User

🛠️ 1. Vulnerability Detection First, I checked the permissions of the directory where the BenimPOS application is installed using the AccessChk.exe tool developed by Sysinternals: Command Used: accesschk.exe -dqvw "C:\Program Files (x86)\BenimPOS"

Obtained Result: RW Everyone FILE_ALL_ACCESS RW BUILTIN\Users FILE_ALL_ACCESS

📌 FILE_ALL_ACCESS permissions have been granted to the "Everyone" and "BUILTIN\Users" groups. This means that any standard user can modify the application's .exe or .dll files. 📸 A screenshot of this output is provided below:

2. Exploitation of the Vulnerability With these permissions, I replaced the BenimPOS.exe file in the application directory with a custom harmless .exe file I created. 📦 Malicious EXE Example (launches calc.exe): import subprocess import sys import traceback

try: subprocess.Popen(r"C:\Windows\System32\calc.exe") except Exception as e: with open("error_log.txt", "w") as f: f.write(traceback.format_exc()) sys.exit(1)

• I converted this script into an .exe file (e.g., using PyInstaller). • Then, I replaced the original BenimPOS.exe file with this new executable. 🔁 Program Launch: • Instead of opening BenimPOS, the calculator (calc.exe) was executed. 📸 Screenshot (calc.exe launched):

🧨 3. Impact and Risk The impact of this vulnerability is critical: Category Description Privilege Escalation A standard user can impersonate processes with administrative privileges. Malicious Code Injection An EXE or DLL file can be modified to insert a backdoor. Application Manipulation The POS application can be altered with malicious functionalities to deceive users.

---

🩹 4. Recommended Solution

1. Standard users should not have write permissions in the application installation directory.
2. Only the following groups should have write access to the C:\Program Files (x86)\BenimPOS directory: o Administrators o SYSTEM
3. Access Control Lists (ACLs) should be properly configured during installation.