Fixed an exploit that allowed anyone to do nz_qr.

Zet0rz / nzombies

A GM13 Nazi Zombies style (WIP) gamemode

GNU General Public License v3.0

73 stars 79 forks source link

Fixed an exploit that allowed anyone to do nz_qr. #619

Closed Ethorbit closed 3 years ago

Ethorbit commented 6 years ago

Original discovery by Scarpia: http://steamcommunity.com/id/scarpia1/

The command nz_qr did not have an admin check. The nz_test1 command doesn't either, but doesn't look harmful.

minin43 commented 6 years ago

What does that command even do in the first place?

Ethorbit commented 6 years ago

No clue why it's in the gamemode, but it allows you to restart the current map. RunConsoleCommand("changelevel", game.GetMap()) (Also I am sorry for the argument we had earlier. Entirely my fault.)

Alig96 commented 6 years ago

If you're wondering why it's in the game mode it's for development. Makes it easy to type qr (Zet0rz changed it to nz_qr) to restart the current map rather than typing out the whole command

Ethorbit commented 3 years ago

So 3 years later and this is still a vulnerability that exists.. I can just join any NZ server right now and restart the map on everybody as many times as I want!

@Alig96 @Zet0rz Please fix. I know you guys have moved on, but people still download from these Git projects and host servers.