Skip to content

Security Issue: fnc_switchPlayer #304

@Torndeco

Description

@Torndeco

https://github.com/CBATeam/CBA_A3/blob/master/addons/common/fnc_switchPlayer.sqf#L69-L71

You are compiling code (not compile final) as a global varibale.
PublicVariable this to everyone
Then remoteexec the code

There is no real reason to have this as a function that is compiled on the fly, it doesn't change.


In its current state its possible for hacker to compile a new function, sent it to all clients/servers.
Then remoteexec it. all the hacker just needs to worry about battleye script filters....

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions