removeJob - any player can delete any other players multijob records (no auth)

[Pajt9whauht283as]

Description

ps-multijob:server:removeJob in server/sv_main.lua (lines 271-279) lets any player delete the multijob record of any other player without any authorization check:

RegisterNetEvent('ps-multijob:server:removeJob', function(targetCitizenId)
    MySQL.Async.execute('DELETE FROM multijobs WHERE citizenid = ?', { targetCitizenId }, function(affectedRows)
        if affectedRows > 0 then
            print('Removed job: ' .. targetCitizenId)
        else
            print('Cannot remove job: ' .. targetCitizenId)
        end
    end)
end)

Compare with ps-multijob:removeJob (lines 263-267) which operates on the caller's own player (Player.PlayerData.citizenid) — the server: variant instead takes an arbitrary targetCitizenId straight from the client packet and executes a raw DELETE against the multijobs table.

There is:

• no check that targetCitizenId equals the caller's citizenid
• no permission check (no admin/job-boss check)
• no rate limiting

Impact

Any player can wipe the multijob entries of any other player (or of the entire server population) at will:

• victims permanently lose their secondary jobs until an admin manually restores them
• combined with whitelisted jobs (whitelistedjobs config), the attacker can strip players of whitelisted job access they paid/earned
• no audit trail is created (plain print to console only)

Suggested fix

• Restrict the event to the caller's own citizenid (mirror the logic of ps-multijob:removeJob), or
• Require an admin permission check (e.g. QBCore.Functions.HasPermission(source, "admin")) before the DELETE, and
• Log the deletion with the actor's identifier.

Affected file

server/sv_main.lua - ps-multijob:server:removeJob