Attackers with local access to the medical office computer can 
escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by 
overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:\Elefant1" which is 
writable for all users. In addition, the Elefant installer registers two
 Firebird database services which are running as “NT AUTHORITY\SYSTEM”. 

Path: C:\Elefant1\Firebird_2\bin\fbserver.exe

Path: C:\Elefant1\Firebird_2\bin\fbguard.exe


Both service binaries are user writable. This means that a local 
attacker can rename one of the service binaries, replace the service 
executable with a new executable, and then restart the system. Once the 
system has rebooted, the new service binary is executed as "NT 
AUTHORITY\SYSTEM".

SEC Consult Vulnerability Lab CWE-250

SEC Consult Vulnerability Lab CWE-276

SEC Consult Vulnerability Lab CWE-732

SEC Consult Vulnerability Lab https://hasomed.de/produkte/elefant/ [No types assigned]

SEC Consult Vulnerability Lab https://r.sec-consult.com/hasomed [No types assigned]