This House is Haunted: a decade old RCE in the AION client

TL;DR I found a RCE in the AION client starting from 3.0 (not confirmed the latest version vulnerable) using the built-in housing system. Private servers are still vulnerable. Important Note In the initial version of this post I wrote that the housing system was removed in 5.0 but some players made me notice that this is wrong indeed the housing system is still there in the retail version of AION…