Donation system

[Ific]

Hello, one guy was stole alot of points from my server,Idk how, maybe it's due paypal auto system?

or daopay?


:thumbup:

 

[ExibeR]

Woot? Could you explain a bit better

 

[Ific]

Yes,

Look, Idk how but an guy, was stole a lot of points from the webpage , I has Daopay system and Paypal system. maybe is due the paypal automathic system?

 

[ExibeR]

Yes, he most likely use a certain SQL Injection on your PayPal system. That why no one uses PayPal for automatic donations yet.

 

[Onizuka]

Well are you sure that your Daopay pin code for points can not be used few times?

 

[mysql]

How can you prevent this from happening then?

 

[exique]

@up
I've got the same question

 

[Ific]

thanks!

so u know how I can delete the vIP acces from some players?

 

[Ific]

Well are you sure that your Daopay pin code for points can not be used few times?

How I can chek it?

 

[ExibeR]

You can prevent it by solving the weaknesses in the code.

 

[Fare]

in daopay webpage, login there, click products, check all your producs(click edit), and check, did they got Validity to 1 COUNTS[/B, not days. Becouse if they are 1 days Validity, then he can use one code unlimited times, for 24 hours.

 

[ExibeR]

in daopay webpage, login there, click products, check all your producs(click edit), and check, did they got Validity to 1 COUNTS[/B, not days. Becouse if they are 1 days Validity, then he can use one code unlimited times, for 24 hours.

That's not the problem here. The problems he's having is that players use a SQLInjection to receive points from PayPal. They skip the payment, and goes directly to Paypal/Result page.

 

[NilssoN042]

Do you know if you have the map (trans) in htdocs? If you dont have it ppls can use same pincode 1000000000000000000000times!

 

[ExibeR]

Do you know if you have the map (trans) in htdocs? If you dont have it ppls can use same pincode 1000000000000000000000times!

That's wrong.

The codes get's registered at DaoPay.com/Affiliate, not in the log file.

 

[Leiken]

Just give paypal donations manually, you won't receive much with paypal so it won't be a hard job.

 

[Fare]

That's not the problem here. The problems he's having is that players use a SQLInjection to receive points from PayPal. They skip the payment, and goes directly to Paypal/Result page.

From where did you know this for sure? xD It can be validity problem also xD

 

[ExibeR]

From where did you know this for sure? xD It can be validity problem also xD

Because my server was attacked with this. If anyone here know how to really run a website, they know where to find the info on what they injected where. Pages which were skipped etc.