"url hacking" avable

[Neyln]

When you chose oponent in ToF you land on site of oponent for example :

"http://test.hentaiheroes.com/battle.html?league_battle=1&id_member=2212"

If you edit url , and set other league_battle , for example league_battle=2 and refresh site, you not land on error site(what should be after invalid link), but you land on fight arena. Fight end normal and fight is count as for league_battle=1. So this mean league_battle id is not validated.

Edit:

league_battle id is same on Wanker 1 , and Wanker 2 urls (if im thinking good , it should be dif and for Wanker 1 = 1, Wanker 2 = 2 ect )

Edited September 5, 2018 by Neyln
Additional research