Bug Bank Deposit Bug

[hakkuo23]

Here's how you do it:

Make sure you have zero in the bank. Now set the deposit to a really large number like 999999999999999999999999999999 and spam the save button.

You will get a huge amount of money in your bank account and have a negative credit amount.

This also works for the withdrawal field.

Can this be patched as users are exploiting this.

Thank you!

 

[hakkuo23]

Also if I disable the bank from XenForo options you can still access it if you know the URL.

 

[Fillip H.]

Are you sure you didn't allow negative credits in the Credits mod?

 

[hakkuo23]

Are you sure you didn't allow negative credits in the Credits mod?

Yes but it's ad credits so I'm not sure if it respects the set options for that specific addon.

 

[Fillip H.]

I see, well the code does have explicit protection against trying to deposit more than they have. It also removes the currency from their "wallet" (e.g. whatever currency table AD Credits uses) instantly after depositing, so I honestly don't see how this is possible.

I don't know if XenForo supports a master/slave database setup and there may be some delay in replicating the data? I'm honestly stumped, it's not an issue I can replicate anywhere so I don't know what to do =/

 

[DragonByte Technologies]

Hello hakkuo23,

This ticket has now been closed with the status Cannot Reproduce.

We hope your issue or question has been addressed to your satisfaction. If not, please feel free to re-open it by clicking this link.

If you have any further issues or questions, please feel free to start a new support ticket via the button at the top of every page.

Thank you!