[Raptor]

one of our members discovered a bug that allows any member to steal money from someone elses account using the donate cash function because it just relies on a simply GET request in the form of

casino.php?recipients=fusen&amount=100&do=donate&donate=Donate

you can force users to give cash by simply abusing the fact the a forum allows html.

by using a

<img src="casino.php?blahblah" height="0" width="0">

no one can see what's happening but every visit will force a donate through as long as the page viewer has enough cash.

to do a simple fix simply make the donate check code make sure that the form was sent via POST and not GET, still because the forum allows for HTML you could get past this still be creating a hidden form that is automatically submitted on pageload that can then force a POST request.

I'd say the safest securist method would be to create a hash inside the form in a hidden variable that is something like your username salted with a random word that is checked on the donate processing bit.

I can confirm this backdoor is there - as I discovered this particular member stealing $1000's from others' accounts.

Please fix asap