From 6ad62a5a46083f52628b0f2ef4c2bbb5bf94707c Mon Sep 17 00:00:00 2001 From: Rushaway Date: Sun, 20 Sep 2026 15:18:44 +0200 Subject: [PATCH 1/2] fix: format-string vulnerability in printAdminList printAdminList() passed a dynamically-built string (which can embed an admin's own display name, via GetClientName/GetClientNameOfAdminId) as the format-string argument itself: CPrintToChat(client, resolvedAdminsAndGroups[i]); If that string contains a '%' character (nothing stops an admin's Steam display name from containing one), it gets interpreted as a Format() directive instead of literal text, which can read past the (nonexistent) variadic arguments and crash or garble the sm_admins output for every viewer, not just the admin whose name triggered it. Fixed by passing it as data instead: CPrintToChat(client, "%s", ...). Co-Authored-By: Claude Sonnet 5 --- addons/sourcemod/scripting/AdvancedAdminList.sp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/sourcemod/scripting/AdvancedAdminList.sp b/addons/sourcemod/scripting/AdvancedAdminList.sp index 06f822a..760a725 100644 --- a/addons/sourcemod/scripting/AdvancedAdminList.sp +++ b/addons/sourcemod/scripting/AdvancedAdminList.sp @@ -340,7 +340,7 @@ public void printAdminList(int client, char[][] resolvedAdminsAndGroups, int res CPrintToChat(client, "{green}[SM] {lightgreen}Admins %s", resolvedAdminGroupsLength <= 0 ? "are offline" : "currently online:"); for (int i = 0; i < resolvedAdminGroupsLength; i++) - CPrintToChat(client, resolvedAdminsAndGroups[i]); + CPrintToChat(client, "%s", resolvedAdminsAndGroups[i]); } public void ReloadAdminList() From ca8d0e60353e5038dbabd7559d31f21551f6dda3 Mon Sep 17 00:00:00 2001 From: Rushaway Date: Mon, 21 Sep 2026 11:18:57 +0200 Subject: [PATCH 2/2] Bump version to 2.1.8 --- addons/sourcemod/scripting/AdvancedAdminList.sp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/addons/sourcemod/scripting/AdvancedAdminList.sp b/addons/sourcemod/scripting/AdvancedAdminList.sp index 760a725..18918a8 100644 --- a/addons/sourcemod/scripting/AdvancedAdminList.sp +++ b/addons/sourcemod/scripting/AdvancedAdminList.sp @@ -53,7 +53,7 @@ public Plugin myinfo = name = "Advanced Admin List", author = "maxime1907, .Rushaway", description = "An advanced admin list system", - version = "2.1.7", + version = "2.1.8", url = "" };