vbBux / vbPlaza v1.5.8 has been released!

A quick release to address a critical bug.

Get it at --> https://vborg.vbsupport.ru/showthread.php?t=106953

A NOTE: This will be one of the last releases of vbBux / vbPlaza in its V1.x format.

But do not fear, vbBux / vbPlaza V2.0 is in the pipeline and will be bigger and better than before

U ask how can it be bigger and better? Stay tuned!!!

-CMX

[Shazz]

Originally Posted by Exitilus

I also know Tehste is working on a Point System (Paid) and eventually a store as well. So hopefully other options will come around.

Also the other guy the name starting with a "w"
Posted one about a new paid one as well.

[Deimos]

Urgh, I can see where this is going

Rather than having one well made point/store system, we're going to have 2+ different versions, bit like the 2 arcade scripts out there
Would be alot better, in my opinion, if everyone worked together to make one kick ass system.

[thepub]

question about the bank and points, how can the admin reset the bank and all the users points to zero without having to manually do it one member at a time?

[Insert Username]

Originally Posted by thepub

question about the bank and points, how can the admin reset the bank and all the users points to zero without having to manually do it one member at a time?

In the Admin CP, go to vbBux > Mass Points Givaway. At the bottom of that page is an option to reset all points to zero.

[Greek Wizard]

Originally Posted by Acers

here is a temporary fix, i have tested this locally only for the donate function and its working as far as this exploit goes, and since the same logic can be taken for other places where its used we can replace there

go to your vbplaza folder, find occurrences of the following:
includes/function_vbplaza.php
find around line 152(depending on the version you have)

PHP Code:

$message = strip_tags($message); 


make that

PHP Code:

$message = htmlspecialchars($message); 


go to
vbplaza/action.admindonate.php (line 133)

PHP Code:

$action['reason'] = strip_tags($action['reason']); 


make that

PHP Code:

$action['reason'] = htmlspecialchars($action['reason']); 


goto
vbplaza/action.changeotherusertitle.php (line 136)

PHP Code:

$newusertitle_stripped = strip_tags($newusertitle); 


make that

PHP Code:

$newusertitle_stripped = htmlspecialchars($newusertitle); 


goto
vbplaza/action.changeusertitle.php (line 87)

PHP Code:

$newusertitle_stripped = strip_tags($newusertitle); 


make that

PHP Code:

$newusertitle_stripped = htmlspecialchars($newusertitle); 


goto
vbplaza/action.donate.php (line 164)

PHP Code:

$action['reason'] = strip_tags($action['reason']); 


make that

PHP Code:

$action['reason'] = htmlspecialchars($action['reason']); 


goto
vbplaza/action.gift.php (line 209)

PHP Code:

$action['giftmessage'] = strip_tags($action['giftmessage']); 


make that

PHP Code:

$action['giftmessage'] = htmlspecialchars($action['giftmessage']); 


goto
vbplaza/action.ribbons.php (line 218)

PHP Code:

$action['ribbonmessage'] = strip_tags($action['ribbonmessage']); 


make that

PHP Code:

$action['ribbonmessage'] = htmlspecialchars($action['ribbonmessage']); 


the above fixes one part of the exploit. Ofcourse there might be other issues involved also, i am still looking around and maybe others are also.

Please note that there might be other code areas that can be exploited also which i don't know yet. Don't think you are safe just by doing the above. The full exploit and what caused it has not been released so all this is guesswork to find the vulnerable part.(btw if this was not one part of exploit, even then it should be in part of the fix as the original code above can be exploited.I just looked at the code and saw this cos the original poster had mentioned something to do with pm text. Wait for an official fix or atleast don't blame me

For those using this fix, I have discovered that when you change this:

go to your vbplaza folder, find occurrences of the following:
includes/function_vbplaza.php
find around line 152(depending on the version you have)

PHP Code:

$message = strip_tags($message); 


make that

PHP Code:

$message = htmlspecialchars($message); 


when a user quotes another user, instead of them getting 3 or 5 vbBux (whatever you have set) for a regular reply, it in fact gives them 50+ for each quote

Acers, any idea why this would cause that?

[giovannicosta]

when I click the link in the first post it says I don't have permission to access it

[Shazz]

Originally Posted by giovannicosta

when I click the link in the first post it says I don't have permission to access it

Its currently removed from vB.org untill the exploit is either fixed or a new version comes out

[tfusion]

arghh... Wish i find a download for it...

I heard its only the PM part fo the vbplaza that has the problem..

[Black Widow]

can someone give me a download link of this hack so i can try to find a fix?

[Shazz]

Originally Posted by tfusion

arghh... Wish i find a download for it...

I heard its only the PM part fo the vbplaza that has the problem..

Donation part :|