catsethecat / vrmod-module

openvr module for garry's mod
zlib License
122 stars 32 forks source link

ShellExecuteA introduces potential exploitability #10

Open jorjic opened 2 years ago

jorjic commented 2 years ago

Don't use ShellExecuteA to execute a batch file because this could be chained with an exploit that replaces the contents of the batch file, or be manipulated to target a different batch file. This is not exploitable itself but it's not worth it to introduce this risk.

https://github.com/catsethecat/vrmod-module/blob/342f52704982ee3e48fd1a3d9e77194c5d568caa/src/vrmod.cpp#L554