[BUG] In Billing Module.

This bug can allow the hacker to edit value of max player or duration invoice to 0 and install the game for free.

- Fixed by this edit.

modules/simple-billing/add_to_cart.php

@@ -60,8 +60,11 @@ function exec_ogp_module()
 	{
 		$price_slot=$row_service['price_year']*12;
 	}
+	else
+	{
+		$price_slot=$row_service['price_monthly'];
+	}
 	
-	$price = $_POST['max_players']*$price_slot*$_POST['qty'];
 	
 	//Game Server Values
 	$ip_id = $_POST['ip_id'];
@@ -75,6 +78,13 @@ function exec_ogp_module()
 	$tax_amount = $settings['tax_amount'];
 	$currency = $settings['currency'];
 	
+	if($max_players < 10 || $qty < 1){
+		$max_players = 12;
+		$qty = 1;
+	}
+	
+	$price = $max_players*$price_slot*$qty;
+	
 	global $view;
 		
 	if( isset( $_POST["add_to_cart"] ) )