[cashpath]

Originally Posted by nighteyes

Just so you know there's a HUGE FLAW in this hack. A user can just save a copy of the vbookie thread to their computer, point the form to the http:// address of the website and bet at whatever odds they choose.

The solution is not setting odds based on the hidden form variables:
<input type="hidden" name="odds2[1]" value="10">
<input type="hidden" name="odds2[1]" value="1">

But by taking the item id:
<input type="hidden" name="item_id" value="1680" />

And grabbing the current odds from the database itself.

Yes this flaw has already been pointed out the fix for it has already been pointed out also