[Quarterbore]

Originally Posted by Bernd

Ok, thanks for explaining. I'll try that one and post the results.

				// check if the user has already OK'd the points removal
				if ($vbulletin->options['vbbux_attachconfirmpage'] && ($_GET['download'] != '1'))

is the only place in vbplaza_attachment_start.php where "POST" is located. Doesn't seem like that's causing the issue though. To be certain i have replaced it with "GET", but a link with STC=1 will still download without showing the vbplaza download attachment template or substracting the points.

Could there be a plugin hooked into attachment somewhere that contains POST? Still seems to be there's something wrong in the above mentioned php.

I am in the middle of a major progaming effort myself so I can't take the time to debug this but I am confident that the line of code posted above is NOT the code that is the problem ...

I believe you will find the problem somewhere in the pluggin system or one of the hooks and that the code you will be looking for is more like:

<form action=somescript.php method=get ..........>

That code could be just about anywhere however. As I said, I would look in the plugin and hooks, then I would look at the php files for the script...

The developer should be able to advise in seconds where the code is that does this update however...

Good luck and if I find the time I can try to work on it but right now I have a huge project of my own that is taking all my free time and this "Security Gap" does not affect me and my sites at this time...