Headline/Gangs

SQL Injection

Closed this issue · 1 comments

MSWS commented

It is possible for players to SQL Inject by changing their gang name. The name is not properly escaped in the code, so for example " or "" would break a large portion of the database.

Headline commented

Thanks! A pretty serious reason to avoid using this plugin entirely until a fork is properly maintained