Hello! This is my first ESX related post on this forum. I’ve seen some highly vulnerable resources posted on the forums that have caught little to no attention to the issues in the resources. Some of these resources have been left, without updates for months, or even years. Many ESX server owners/“developers” don’t have the skills or knowledge to fix, or even identify these vulnerabilities. This is what brought me to fixing these issues and posting them publicly.
This thread is dedicated to exploitable resources of ESX. As time goes on, I will be adding more resources that I’ve fixed to the thread.
If you have any resources that you suspect to be vulnerable and would wish for me to provide a fix, please post it below, or privately message me.
Thank you for reading, here’s the updated resources.
ESX_CommunityService
Original
Creator: @Apostolos_Iatridis
Forum: [Release] [ESX] ESX_CommunityService
GitHub: GitHub - apoiat/ESX_CommunityService: Fivem [ESX] An alternative form of punishment and reformation for criminals.
Vulnerabilities
The issue with this resource is the fact that it is highly vulnerable to client side executors. Players are able to execute server events and target any player (and the whole server) completely unchecked.
Specific Vulnerabilities
TriggerServerEvent("esx_communityservice:endCommunityServiceCommand")
Can be used to force anyone out of community service, even if time is not near the end.
TriggerServerEvent("esx_communityservice:sendToCommunityService", targetId, numberActions)
Can be used to force anyone & everyone into community service for any amount of time/actions.
General Exploits
- Force anyone into community service for any time
- Force anyone out of community service
Updated
Creators: @Apostolos_Iatridis & @ATG
GitHub: GitHub - ATG-Github/ESX_CommunityService: Fivem [ESX] An alternative form of punishment and reformation for criminals with Protected server events.
Download: GitHub Release
esx_jail
Original
Creator: @Hawaii_Beach
Forum: [Release] esx_jail
GitHub: GitHub - esx-community/esx_jail: Let cops jail people, an FiveM project
Vulnerabilities
The issue with this resource is the fact that it is highly vulnerable to client side executors. Players are able to execute server events and target any player (and the whole server) completely unchecked.
Specific Vulnerabilities
TriggerServerEvent("esx_jail:sendToJail", targetId, time)
Can be used to force anyone & everyone into jail for any amount of time.
General Exploits
- Force anyone into jail, for any time
Updated
Creators: @Hawaii_Beach & @ATG
GitHub: GitHub - ATG-Github/esx_jail: Let cops jail people, a FiveM project with protected server events.
Download: GitHub Release
esx-qalle-jail
Original
Creator: @qalle
Forum: [Release-ESX Jail] Prisonwork, Anti Combat Log, Mugshot
GitHub: GitHub - qalle-git/esx-qalle-jail: Jailsystem, working prisonwork to earn small amount of cash!
Vulnerabilities
The issue with this resource is the fact that it is highly vulnerable to client side executors. Players are able to execute server events and target any player (and the whole server) completely unchecked.
Specific Vulnerabilities
TriggerServerEvent("esx-qalle-jail:jailPlayer", targetId, time, reason)
Can be used to force anyone & everyone into jail for any amount of time, and can specify a message to spam the chat with.
TriggerServerEvent("esx-qalle-jail:unJailPlayer", identifier)
Can be used to force anyone out of jail, even if time is not near the end.
TriggerServerEvent("esx-qalle-jail:prisonWorkReward")
Can be used to give player 13-21$. This could be put into a loop to get the player a lot of lunch money, even if they aren’t in jail.
General Exploits
- Force anyone into jail, for any time, and any reason
- Force anyone out of jail
- Exploit money
Updated
Creators: @qalle & @ATG
GitHub: GitHub - ATG-Github/esx-qalle-jail: Jailsystem, working prisonwork to earn small amount of cash with protected server events!
Download: GitHub Release
esx_billing
Original
Creator: @GiZz
GitHub: https://github.com/ESX-Org/esx_billing
Vulnerabilities
The issue with this resource is the fact that it is highly vulnerable to client side executors. Players are able to execute server events and target any player (and the whole server) completely unchecked.
Specific Vulnerabilities
TriggerServerEvent("esx_billing:sendBill", playerId, society, reason, fineAmount)
Can be used to send a bill to any and all players from any society, any reason, and any fine amount. This can be put in a loop to spam this, also clogging your database.
General Exploits
- Send bills to any player, from any society, with any reason, and any fine amount
Updated
Creators: @GiZz & @ATG
GitHub: GitHub - ATG-Github/esx_billing: FXServer ESX Billing with server side protection.
Download: GitHub Release
esx_drugs
Original
Creator: @ig0ne
Forum Post: [Release] [ESX] [Drugs]
GitHub: https://github.com/ESX-Org/esx_drugs
Vulnerabilities
The issue with this resource is the fact that it is highly vulnerable to client side executors. Players are able to execute server events and target any player (and the whole server) completely unchecked.
Specific Vulnerabilities
TriggerServerEvent("esx_drugs:pickedUpCannabis")
TriggerServerEvent("esx_drugs:processCannabis")
TriggerServerEvent("esx_drugs:sellDrug")
Can be used to emulate a player collecting, processing, and selling the drug. This is considered a money exploit.
Config.CircleZones = {
........
}
This one is less of an exploit but, more of a concern of server owners. The location of the drug can be dumped because it’s stored in the client lua config.
General Exploits
- Fake collect/process/sell drugs
- Steal drug location
Updated
Creators: @ig0ne & @ATG
GitHub: GitHub - ATG-Github/esx_drugs: FXserver ESX Drugs with protected events.
Download: GitHub Release
esx_drugs (refactored)
Original
Creator: @diorgera
Forum Post: Esx_drugs - Refactored from esx_illegal_drugs
GitHub: GitHub - diorgesl/esx_drugs
Vulnerabilities
The issue with this resource is the fact that it is highly vulnerable to client side executors. Players are able to execute server events and target any player (and the whole server) completely unchecked.
Specific Vulnerabilities
TriggerServerEvent("esx_drugs:startHarvest")
TriggerServerEvent("esx_drugs:startTransform")
TriggerServerEvent("esx_drugs:startSell")
Can be used to emulate a player collecting, processing, and selling the drug. This is considered a money exploit.
Config.Drugs= {
........
}
This one is less of an exploit but, more of a concern of server owners. The location of the drug can be dumped because it’s stored in the client lua config.
General Exploits
- Fake collect/process/sell drugs
- Steal drug location
Updated
Creators: @diorgera & @ATG
GitHub: GitHub - ATG-Github/esx_drugs-1: esx_drugs (refactored) with protected events
Download: GitHub Release
esx_illegal_drugs
Original
Creator: @XxFri3ndlyxX
GitHub: GitHub - XxFri3ndlyxX/esx_illegal_drugs: This is the old esx_drugs
Vulnerabilities
The issue with this resource is the fact that it is highly vulnerable to client side executors. Players are able to execute server events and target any player (and the whole server) completely unchecked.
Specific Vulnerabilities
TriggerServerEvent("esx_drugs:startHarvestCoke")
TriggerServerEvent("esx_drugs:startTransformCoke")
TriggerServerEvent("esx_drugs:startSellCoke")
TriggerServerEvent("esx_drugs:startHarvestMeth")
TriggerServerEvent("esx_drugs:startTransformMeth")
TriggerServerEvent("esx_drugs:startSellMeth")
TriggerServerEvent("esx_drugs:startHarvestWeed")
TriggerServerEvent("esx_drugs:startTransformWeed")
TriggerServerEvent("esx_drugs:startSellWeed")
TriggerServerEvent("esx_drugs:startHarvestartium")
TriggerServerEvent("esx_drugs:startTransformOpium")
TriggerServerEvent("esx_drugs:startSellOpium")
TriggerServerEvent("esx_drugs:stopHarvestCoke")
TriggerServerEvent("esx_drugs:stopTransformCoke")
TriggerServerEvent("esx_drugs:stopSellCoke")
TriggerServerEvent("esx_drugs:stopHarvestMeth")
TriggerServerEvent("esx_drugs:stopTransformMeth")
TriggerServerEvent("esx_drugs:stopSellMeth")
TriggerServerEvent("esx_drugs:stopHarvestWeed")
TriggerServerEvent("esx_drugs:stopTransformWeed")
TriggerServerEvent("esx_drugs:stopSellWeed")
TriggerServerEvent("esx_drugs:stopHarvestOpium")
TriggerServerEvent("esx_drugs:stopTransformOpium")
TriggerServerEvent("esx_drugs:stopSellOpium")
Can be used to emulate a player collecting, processing, and selling the drug. This is considered a money exploit.
Config.Zones = {
........
}
Config.Map= {
........
}
This one is less of an exploit but, more of a concern of server owners. The location of the drug can be dumped because it’s stored in the client lua config.
General Exploits
- Fake collect/process/sell drugs
- Steal drug location
Updated
Creators: @XxFri3ndlyxX & @ATG
GitHub: GitHub - ATG-Github/esx_illegal_drugs: This is the old esx_drugs with protected events
Download: GitHub Release
Anyone who uses any of the above is also recommended to use this to further protect your server!
)
. How about, try removing yourself from admin (setadmin id 0 and setgroup ip user) and setting your job to unemployed, and then trigger the server event to jail OR do it through the jail menu. It won’t go through, and it will post it in the server console.
