Wondershare UBackit 2.0.5 Wsbackup Service unquoted search path

Summaryinfo

A vulnerability labeled as problematic has been found in Wondershare UBackit 2.0.5. This affects an unknown part of the component Wsbackup Service. The manipulation results in unquoted search path. This vulnerability is known as CVE-2022-50904. Attacking locally is a requirement. Furthermore, an exploit is available.

Detailsinfo

A vulnerability was found in Wondershare UBackit 2.0.5. It has been classified as critical. Affected is an unknown part of the component Wsbackup Service. The manipulation with an unknown input leads to a unquoted search path vulnerability. CWE is classifying the issue as CWE-428. The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Wondershare UBackit 2.0.5 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in the wsbackup service to inject malicious executables that would run with LocalSystem permissions during service startup.

The weakness was published by Luis Martinez as 50758. The advisory is shared for download at exploit-db.com. This vulnerability is traded as CVE-2022-50904 since 01/10/2026. The exploitability is told to be difficult. The attack needs to be approached locally. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1574.009.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (50758). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Wondershare

Name

• UBackit

Version

• 2.0.5

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion