`addWeaponAmmo` trusts client-supplied item name and amount - craft unlimited ammo / duplicate any inventory item

[Pajt9whauht283as]

Description

msk_weaponammoitem:addWeaponAmmo in server.lua (lines 12-28) trusts client-supplied data.item and data.amount with no validation against Config.AmmoPacks:

RegisterNetEvent('msk_weaponammoitem:addWeaponAmmo')
AddEventHandler('msk_weaponammoitem:addWeaponAmmo', function(weaponName, item, data)
    local src = source
    local xPlayer = ESX.GetPlayerFromId(src)
    local hasItem = xPlayer.getInventoryItem(item)
    if not hasItem or hasItem.count == 0 then return end

    xPlayer.removeInventoryItem(item, 1)
    xPlayer.addInventoryItem(data.item, data.amount)  -- <-- client-controlled item + amount

    local hasAmmo = xPlayer.getInventoryItem(data.item)
    local ammoToAdd = data.amount
    if hasAmmo and hasAmmo.count > 0 then ammoToAdd = ammoToAdd + hasAmmo.count end

    xPlayer.updateWeaponAmmo(weaponName, ammoToAdd)
    SetPedAmmo(GetPlayerPed(xPlayer.source), joaat(weaponName), ammoToAdd)
end)

The only server-side check is hasItem.count > 0 for the item the client picked as item (line 16-17). Everything else — data.item, data.amount, weaponName — is arbitrary client input.

Impact

• Any player with a single ammo pack (or any item the client passes as item) can spawn unlimited quantities of any inventory item: TriggerServerEvent('msk_weaponammoitem:addWeaponAmmo', 'WEAPON_PISTOL', 'ammo-9', {item = 'ammo-rifle', amount = 99999}) gives 99999 rifle ammo
• Item name is not restricted to the Config.AmmoPacks keys, so a crafted payload can duplicate other items as well
• Ammo count is also written directly with SetPedAmmo using the client-chosen weaponName — free max ammo on any weapon the player owns

Suggested fix

• Only accept item/data.item values that exist in Config.AmmoPacks, and derive data.amount from the config instead of the payload:

RegisterNetEvent('msk_weaponammoitem:addWeaponAmmo')
AddEventHandler('msk_weaponammoitem:addWeaponAmmo', function(weaponName, item)
    local src = source
    local xPlayer = ESX.GetPlayerFromId(src)
    local ammoCfg = Config.AmmoPacks[item]
    if not ammoCfg then return end

    local hasItem = xPlayer.getInventoryItem(item)
    if not hasItem or hasItem.count == 0 then return end

    xPlayer.removeInventoryItem(item, 1)
    xPlayer.addInventoryItem(ammoCfg.item, ammoCfg.amount)
    xPlayer.updateWeaponAmmo(weaponName, ammoCfg.amount)
end)

Affected file

server.lua