Description
qb-garages:server:spawnvehicle trusts client-supplied vehicle/plate/coords and never verifies that the vehicle belongs to the requesting player:
RegisterNetEvent('qb-garages:server:spawnvehicle', function(vehicle, plate, coords)
local src = source
local Player = QBCore.Functions.GetPlayer(src)
if not Player then return end
local vehicle = vehicle
local plate = plate
local coords = coords
local canDeposit = true
...The deposit handler later checks owner citizenship (melon == Player.PlayerData.citizenid at the canDeposit branch), but spawnvehicle has no ownership check at all. Any client can spawn any vehicle model - including a personal car owned by another player, or any plate they invent - at any coordinates, because nothing ties vehicle/plate to the player's actual garage entries.
Impact
- Spawn arbitrary vehicle models anywhere (vehicle spawning exploit).
- Spawn plates already in use by other players, causing plate conflicts on owned vehicles.
- Bypass garage spawn costs / parking fees.
Suggested fix
- Server-side lookup: the vehicle entry must exist in the server garages data and match the requesting player's citizenid (or a state-authed shared vehicle); plate and coords must be resolved from the stored record, not from client input.
Affected file
server.lua - qb-garages:server:spawnvehicle
Description
qb-garages:server:spawnvehicletrusts client-supplied vehicle/plate/coords and never verifies that the vehicle belongs to the requesting player:The deposit handler later checks owner citizenship (
melon == Player.PlayerData.citizenidat thecanDepositbranch), butspawnvehiclehas no ownership check at all. Any client can spawn any vehicle model - including a personal car owned by another player, or any plate they invent - at any coordinates, because nothing tiesvehicle/plateto the player's actual garage entries.Impact
Suggested fix
Affected file
server.lua-qb-garages:server:spawnvehicle