My First Release (Lottery System)

[xXTrevXx]

This is for RevCMS, im using Micro's version of Rev, so you may need to add/take away a few things to get it to work 100%

Add Lottery.php, to your main skin folder, with all your pages in it., also add this page to your navigator
Add the lottery2.php anywhere you want really (set this to run every days, or however often you want to pick winners, using either task scheduler, or some other way to run this based on time. or even manually if you want, so you can see the little bit of output.) i recommend looking at the lotto2 file, and seeing how it works.

lotto page

You must be registered for see links

You must be registered for see links

output page:

You must be registered for see links

You must be registered for see links

Spoiler: lotto.zip

You must be registered for see links

and you need to add a few tables to your database:

Spoiler: sql

CREATE TABLE `lotto` (
  `username` varchar(50) NOT NULL,
  `value` varchar(4) NOT NULL,
  `winner` int(1) NOT NULL DEFAULT '0',
  `winning_numbers` varchar(4) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=latin1;

CREATE TABLE `lotto_winners` (
  `username` varchar(30) NOT NULL,
  `time` varchar(100) DEFAULT 'CURDATE()',
  `winning_number` varchar(4) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
COMMIT;

plus, you need to edit the first lines in BOTH of the files, to config to your database, or just replace it with your include_once of your connection.php, if you already use mysqli, and already import your database connection

 

[xFlyx]

hmm, its to easy....

 

[xXTrevXx]

@xFlyx What do you mean?

 

[Jerry]

@xFlyx What do you mean?

He probably means that it's easy to implement.

 

[xXTrevXx]

Any constructive criticism? Advice? Questions? Im up for anything, thats why i posted this. for people to tell me what im doing wrong so i can make changes to the way i code, and i would LOVE compliments, makes me want to keep learning.

 

[Zachariah]

I don't really like the page it redirects to, it needs to be different aswell.

 

[xXTrevXx]

i mean, the output page is never seen by the users, only by the owner, who runs it to pick the winners, thats why it is 100% basic to atleast see what happened, and if you want it to be 100% automatic (setting a system task to run the lotto2.php, nobody sees it not even you.) but i do see what your saying. Thank you ill have to work on giving it some more detail

 

[Zachariah]

How do users know if they win or not.
 
Also, off topic, where'd you get your cms from?

 

[xXTrevXx]

if you look in the second screenshot i provided, on the lottery page, it has the latest winner, and the winning numbers. the output page is strictly for owners use to see details, if there is no winner, owner can see, and on lotto page, there will be no change to the latest winner and winning number, BUT the overall prize (the prize is amounted by the total amount of tickets bought.) and also as i said im using Micros CMS, i found it here i believe. Its almost completely automated, just gotta set the lotto2.php to run based on time, and its 100% automated

 

[Zachariah]

Ahhh nevermind I see it now. You should change it up abit and make it show the character waving or what not

 

[Pinkman]

Not a bad release for your first time. Nice job. Maybe you should’ve explained it at the start about the output page and only owners or what ever rank can see it.

 

[xXTrevXx]

First relese sorry. i could have given more details. trial and error. thought it was kinda self explanitory, but now that i kinda try to look at it from a different view, its not , ill make a 2.0 and release it

 

[rfrfrfrf]

Is this exploit free?

 

[Hypothesis]

Is this exploit free?

No.

 

[rfrfrfrf]

No.

Can you tell us where the exploit is?