[Andreas]

Security Warning

This Hack contained serious XSS and SQL injection vulnerbilities.
If you downloaded this Hack before 14.08.2005 19:10 CEST I strongly recommend to make the following changes immediately to keep your installation safe.

Security Warning

In vbookie.php (around line 226) find
--------------------------------------------------
if (!$_GET['type'])
	$_GET['type'] = 'OPEN';
--------------------------------------------------

BELOW that ADD
--------------------------------------------------
globalize($_GET, array('type' => STR_NOHTML));
--------------------------------------------------


FIND
--------------------------------------------------
$q = "INSERT INTO " . TABLE_PREFIX . "vbookie_bets_placed (option_id, item_id, userid, bet_amount_placed, bet_odds_against, bet_odds_for, bet_private) VALUES ($k, $item_id, $bbuserinfo[userid], $v, ".$odds1[$k].", ".$odds2[$k].", '$private')";
--------------------------------------------------

REPLACE that with
--------------------------------------------------
$q = "INSERT INTO " . TABLE_PREFIX . "vbookie_bets_placed (option_id, item_id, userid, bet_amount_placed, bet_odds_against, bet_odds_for, bet_private) VALUES ($k, $item_id, $bbuserinfo[userid], $v, ". intval($odds1[$k]).", ".intval($odds2[$k]).", '$private')";
--------------------------------------------------
		

In Template vbookie_main
FIND
--------------------------------------------------
$_GET[type]
--------------------------------------------------

REPLACE that with
--------------------------------------------------
$type
--------------------------------------------------

The ZIP File has been updated accordingly.