From 47876e2c904bc46b56338d32e84115a16444c204 Mon Sep 17 00:00:00 2001 From: passbe Date: Thu, 12 May 2011 23:47:49 +0000 Subject: [PATCH] Stopped storing data type in result table. This will remove the code execution vuln with the renderers engine git-svn-id: https://beef.googlecode.com/svn/trunk@970 b87d56ec-f9c0-11de-8c8a-61c5e9addfc9 --- core/main/handlers/commands.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/main/handlers/commands.rb b/core/main/handlers/commands.rb index b5a6e48c1..69ba61009 100644 --- a/core/main/handlers/commands.rb +++ b/core/main/handlers/commands.rb @@ -44,7 +44,7 @@ module Handlers command_results = get_param(@data, 'results') raise WEBrick::HTTPStatus::BadRequest, "command results empty" if command_results.empty? # save the command module results to the datastore and create a log entry - command_results = {'type' => command_results.class, 'data' => command_results} + command_results = {'data' => command_results} BeEF::Core::Models::Command.save_result(beefhook, command_id, command_friendly_name, command_results) end