!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/alumni/admin/pages/forum/   drwxr-xr-x
Free 46.43 GB of 127.8 GB (36.33%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     index.php (38.69 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php

/********************************************************************************
    - MemHT Portal -
    
    Copyright (C) 2007-2008 by Miltenovik Manojlo
    http://www.memht.com
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your opinion) any later version.
    
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License along
    with this program; if not, see <http://www.gnu.org/licenses/> (GPLv2)
    or write to the Free Software Foundation, Inc., 51 Franklin Street,
    Fifth Floor, Boston, MA02110-1301, USA.
        
********************************************************************************/

if (!defined("_LOAD_PAGE_")) {
    die(
"<table style='padding: 2px; border: 1px solid #999; background-color: #EEE; font-family: Verdana; font-size: 10px;' align='center'><tr><td><b>Error:</b> This file cannot be opened directly!</td></tr></table>");
}

if (isset(
$_GET['op'])) { $op inCode($_GET['op']); } else { $op ""; }
if (isset(
$_GET['id'])) { $id intval($_GET['id']); } else { $id 0; }
if (isset(
$_GET['ok'])) { $ok inCode($_GET['ok']); } else { $ok false; }
if (isset(
$_GET['subop'])) { $subop incode($_GET['subop']); } else { $subop ""; }

if (isset(
$_POST['name'])) { $name eregi_replace("[/_']","-",inCode($_POST['name'])); } else { $name ""; }
if (isset(
$_POST['category'])) { $category intval($_POST['category']); } else { $category 0; }
if (isset(
$_POST['parent'])) { $parent intval($_POST['parent']); } else { $parent 0; }
if (isset(
$_POST['description'])) { $description inCode($_POST['description']); } else { $description ""; }
if (isset(
$_POST['position'])) { $position intval($_POST['position']); } else { $position 0; }
if (isset(
$_POST['status'])) { $status intval($_POST['status']); } else { $status 0; }
if (isset(
$_POST['auth_view'])) { $auth_view intval($_POST['auth_view']); } else { $auth_view 0; }
if (isset(
$_POST['auth_read'])) { $auth_read intval($_POST['auth_read']); } else { $auth_read 0; }
if (isset(
$_POST['auth_write'])) { $auth_write intval($_POST['auth_write']); } else { $auth_write 0; }
if (isset(
$_POST['auth_delete'])) { $auth_delete intval($_POST['auth_delete']); } else { $auth_delete 0; }

function 
fmain() {
    global 
$dblink;
    
    echo 
"<table width='100%' align='center' cellspacing='1' cellpadding='0' class='std_nicetable'>\n";
    
$result $dblink->get_list("SELECT * FROM memht_forum_categories ORDER BY position");
    foreach (
$result as $row) {
        
$c_id intval($row['id']);
        
$c_name outCode($row['name']);
        
$c_description outCode($row['description']);
        
$c_position intval($row['position']);
        
        echo 
"<thead>\n";
        echo 
"<tr><td><b>$c_name</b>";
        if (
$c_description!="") { echo " <img src='images/note.gif' alt='Note' border='0' title=\"header=["._DESCRIPTION_."] body=[$c_description]\">"; }
        echo 
"</td><td width='20%' align='right' valign='top'><a href='admin.php?page=forum&op=editCat&id=$c_id' title='"._MODIFY_."'><img src='images/edit.gif' alt='"._MODIFY_."' border='0'></a> <a href='admin.php?page=forum&op=deleteCat&id=$c_id' title='"._DELETE_."'><img src='images/delete.gif' alt='"._DELETE_."' border='0'></a></td></tr>\n";
        echo 
"</thead>\n";
        echo 
"<tbody>\n";
        
$n 0;
        
$result_forum $dblink->get_list("SELECT * FROM memht_forum_forums WHERE category=$c_id AND parent=0 ORDER BY position");
        foreach (
$result_forum as $row_forum) {
            
$f_id intval($row_forum['id']);
            
$f_name outCode($row_forum['name']);
            
$f_description outCode($row_forum['description']);
            
$f_auth_view intval($row_forum['auth_view']);
            
$f_auth_read intval($row_forum['auth_read']);
            
$f_auth_write intval($row_forum['auth_write']);
            
$f_auth_delete intval($row_forum['auth_delete']);
            
$f_position intval($row_forum['position']);
            
$f_status intval($row_forum['status']);
        
            
$class = (($n++%2)!=0) ? "hlight" "clean" ;
            
            
$mods = array();
            
$authres $dblink->get_list("SELECT m.groupid,g.name FROM memht_forum_moderation AS m JOIN memht_groups AS g ON m.groupid=g.id WHERE m.forum=$f_id");
            foreach (
$authres as $authrow) {
                
$mods[] = outCode($authrow['name']);
            }
            
$forum_mods implode(", ",$mods);

            
$info "<a href='admin.php?page=forum&op=switch&id=$f_id' title='"._OPEN_."/"._CLOSED_."'><img src='images/on_off.gif' alt='"._OPEN_."/"._CLOSED_."' border='0'></a> ";
            if (
$f_status!="1") { $info .= "<img src='images/off.gif' alt='"._CLOSED_."' title='"._CLOSED_."'>"; }else { $info .= "<img src='images/on.gif' alt='"._OPEN_."' title='"._OPEN_."'>"; }
            
            echo 
"<tr><td class='$class'><a href='index.php?page=forum&op=viewForum&id=$f_id&title=".mem_urlencode($f_name)."' title='$f_name'><b>$f_name</b></a>";
            if (
$f_description!="") { echo " <img src='images/note.gif' alt='"._DESCRIPTION_."' border='0' title=\"header=["._DESCRIPTION_."] body=[$f_description]\">"; }
            if (
$forum_mods!="") { echo " <img src='images/neutral.gif' border='0' title=\"header=["._MODERATORS_."] body=[$forum_mods]\">"; }
            echo 
"</td><td width='20%' class='$class' align='right' valign='top'>{$info} <a href='admin.php?page=forum&op=editForum&id=$f_id' title='"._MODIFY_."'><img src='images/edit.gif' alt='"._MODIFY_."' border='0'></a> <a href='admin.php?page=forum&op=deleteForum&id=$f_id' title='"._DELETE_."'><img src='images/delete.gif' alt='"._DELETE_."' border='0'></a></td></tr>\n";
            
//
            
if ($result_forum_s $dblink->get_list("SELECT * FROM memht_forum_forums WHERE parent=$f_id ORDER BY position")) {
                foreach (
$result_forum_s as $row_forum_s) {
                    
$sf_id intval($row_forum_s['id']);
                    
$sf_name outCode($row_forum_s['name']);
                    
$sf_description outCode($row_forum_s['description']);
                    
$sf_auth_view intval($row_forum_s['auth_view']);
                    
$sf_auth_read intval($row_forum_s['auth_read']);
                    
$sf_auth_write intval($row_forum_s['auth_write']);
                    
$sf_auth_delete intval($row_forum_s['auth_delete']);
                    
$sf_position intval($row_forum_s['position']);
                    
$sf_status intval($row_forum_s['status']);
                    
                    
$smods = array();
                    
$sauthres $dblink->get_list("SELECT m.groupid,g.name FROM memht_forum_moderation AS m JOIN memht_groups AS g ON m.groupid=g.id WHERE m.forum=$sf_id");
                    foreach (
$sauthres as $sauthrow) {
                        
$smods[] = outCode($sauthrow['name']);
                    }
                    
$sforum_mods implode(", ",$smods);
        
                    
$sinfo "<a href='admin.php?page=forum&op=switch&id=$sf_id' title='"._OPEN_."/"._CLOSED_."'><img src='images/on_off.gif' alt='"._OPEN_."/"._CLOSED_."' border='0'></a> ";
                    if (
$sf_status!="1") { $sinfo .= "<img src='images/off.gif' alt='"._CLOSED_."' title='"._CLOSED_."'>"; } else { $sinfo .= "<img src='images/on.gif' alt='"._OPEN_."' title='"._OPEN_."'>"; }
                    
                    echo 
"<tr><td class='$class'>&nbsp;&nbsp;&nbsp;<a href='index.php?page=forum&op=viewForum&id=$sf_id&title=".mem_urlencode($sf_name)."' title='$sf_name'>$sf_name</a>";
                    if (
$sf_description!="") { echo " <img src='images/note.gif' alt='"._DESCRIPTION_."' border='0' title=\"header=["._DESCRIPTION_."] body=[$sf_description]\">"; }
                    if (
$sforum_mods!="") { echo " <img src='images/neutral.gif' border='0' title=\"header=["._MODERATORS_."] body=[$sforum_mods]\">"; }
                    echo 
"</td><td width='20%' class='$class' align='right' valign='top'>{$sinfo} <a href='admin.php?page=forum&op=editForum&id=$sf_id' title='"._MODIFY_."'><img src='images/edit.gif' alt='"._MODIFY_."' border='0'></a> <a href='admin.php?page=forum&op=deleteForum&id=$sf_id' title='"._DELETE_."'><img src='images/delete.gif' alt='"._DELETE_."' border='0'></a></td></tr>\n";
                }
            }
            
//
        
}
        echo 
"</tbody>\n";
    }
    echo 
"</table>";
}

function 
addForum($category,$parent,$name,$description,$auth_view,$auth_read,$auth_write,$auth_delete,$status,$ok=false) {
    global 
$dblink;
    
    if (!
$ok) {
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='form_cat' method='post' action='admin.php?page=forum&op=addForum&ok=true'>";
            echo 
"<tr><td><b>"._CATEGORY_."</b></td><td>";
                echo 
"<select name='category'>\n";
                
$result $dblink->get_list("SELECT * FROM memht_forum_categories ORDER BY position");
                foreach (
$result as $row) {
                    
$c_id intval($row['id']);
                    
$c_name outCode($row['name']);
                    
                    echo 
"<option value='$c_id'>$c_name</option>\n";
                }
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._PARENT_."</b></td><td>\n";
            echo 
"<select name='parent'>\n";
            echo 
"<option value='0'>-</option>\n";
            
$result $dblink->get_list("SELECT * FROM memht_forum_forums WHERE parent=0 ORDER BY name");
            foreach (
$result as $row) {
                
$sid intval($row['id']);
                
$name outCode($row['name']);
                    
                echo 
"<option value='$sid'>$name</option>\n";
            }
            echo 
"</select></td></tr>\n";
            echo 
"<tr><td><b>"._NAME_."</b><td><input type='text' name='name' size='40' maxlength='255'>\n";
            echo 
"<tr><td valign='top'><b>"._DESCRIPTION_."</b></td><td>\n";
                
textarea("description","100%","200px",1,"fulladmin");
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._AUTH_VIEW_."</b></td><td>";
                echo 
"<select name='auth_view'>\n";
                    echo 
"<option value='0' selected>"._GUEST_."</option>\n";
                    echo 
"<option value='1'>"._USER_."</option>\n";
                    echo 
"<option value='2'>"._MODERATOR_."</option>\n";
                    echo 
"<option value='3'>"._ADMIN_."</option>\n";
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._AUTH_READ_."</b></td><td>";
                echo 
"<select name='auth_read'>\n";
                    echo 
"<option value='0' selected>"._GUEST_."</option>\n";
                    echo 
"<option value='1'>"._USER_."</option>\n";
                    echo 
"<option value='2'>"._MODERATOR_."</option>\n";
                    echo 
"<option value='3'>"._ADMIN_."</option>\n";
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._AUTH_WRITE_."</b></td><td>";
                echo 
"<select name='auth_write'>\n";
                    echo 
"<option value='0'>"._GUEST_."</option>\n";
                    echo 
"<option value='1' selected>"._USER_."</option>\n";
                    echo 
"<option value='2'>"._MODERATOR_."</option>\n";
                    echo 
"<option value='3'>"._ADMIN_."</option>\n";
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._AUTH_DELETE_."</b></td><td>";
                echo 
"<select name='auth_delete'>\n";
                    echo 
"<option value='0'>"._GUEST_."</option>\n";
                    echo 
"<option value='1'>"._USER_."</option>\n";
                    echo 
"<option value='2' selected>"._MODERATOR_."</option>\n";
                    echo 
"<option value='3'>"._ADMIN_."</option>\n";
                echo 
"</select>\n";
            echo 
"<tr><td><b>"._STATUS_."</b></td><td>";
                echo 
"<select name='status'>\n";
                    echo 
"<option value='1' selected>"._OPEN_."</option>\n";
                    echo 
"<option value='0'>"._CLOSED_."</option>\n";
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<td colspan='2'><input type='submit' name='Submit' value='"._ADD_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>";
    } else {
        
$save true;
        if (
$name=="") { $save false; }
    
        if (
$save) {
            
$lastrow $dblink->get_row("SELECT * FROM memht_forum_forums WHERE category='$category' ORDER BY id DESC LIMIT 1");
            
$newpos intval($lastrow['position']);
            
$newpos++;            
            
$dblink->query("INSERT INTO memht_forum_forums (id,parent,category,name,description,position,auth_view,auth_read,auth_write,auth_delete,status)
                            VALUES (null,'$parent','$category','$name','$description','$newpos','$auth_view','$auth_read','$auth_write','$auth_delete','$status')"
);
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=forum'>";
        } else {
            echo 
"<div align='center' id='errorText'><b>"._FIELDINVALID_."</b></div>";
        }
    }
}

function 
editForum($id,$category,$parent,$name,$description,$auth_view,$auth_read,$auth_write,$auth_delete,$position,$status,$ok=false) {
    global 
$dblink;
    
    
$id intval($id);
    
    
$row_forum $dblink->get_row("SELECT * FROM memht_forum_forums WHERE id='$id'");
    
$f_parent intval($row_forum['parent']);
    
$f_category intval($row_forum['category']);
    
$f_name outCode($row_forum['name']);
    
$f_description outCode($row_forum['description']);
    
$f_auth_view intval($row_forum['auth_view']);
    
$f_auth_read intval($row_forum['auth_read']);
    
$f_auth_write intval($row_forum['auth_write']);
    
$f_auth_delete intval($row_forum['auth_delete']);
    
$f_position intval($row_forum['position']);
    
$f_status intval($row_forum['status']);

    if (!
$ok) {
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='form_cat' method='post' action='admin.php?page=forum&op=editForum&id=$id&ok=true'>";
            echo 
"<tr><td><b>"._CATEGORY_."</b></td><td>";
                echo 
"<select name='category'>\n";
                
$result $dblink->get_list("SELECT * FROM memht_forum_categories ORDER BY position");
                foreach (
$result as $row) {
                    
$c_id intval($row['id']);
                    
$c_name outCode($row['name']);
                    
                    
$selected = ($f_category==$c_id) ? " selected" "";
                    echo 
"<option value='$c_id'{$selected}>$c_name</option>\n";
                }
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._PARENT_."</b></td><td>\n";
            echo 
"<select name='parent'>\n";
            echo 
"<option value='0'>-</option>\n";
            
$result $dblink->get_list("SELECT * FROM memht_forum_forums WHERE parent=0 ORDER BY name");
            foreach (
$result as $row) {
                
$sid intval($row['id']);
                
$name outCode($row['name']);
                
                
$selected = ($f_parent==$sid) ? " selected" "";
                echo 
"<option value='$sid'{$selected}>$name</option>\n";
            }
            echo 
"</select></td></tr>\n";
            echo 
"<tr><td><b>"._NAME_."</b><td><input type='text' name='name' value=\"$f_name\" size='40' maxlength='255'>\n";
            echo 
"<tr><td valign='top'><b>"._DESCRIPTION_."</b></td><td>\n";
                
textarea("description","100%","200px",1,"fulladmin",$f_description);
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._AUTH_VIEW_."</b></td><td>";
                echo 
"<select name='auth_view'>\n";
                if (
$f_auth_view==0) { echo "<option value='0' selected>"._GUEST_."</option>\n"; } else { echo "<option value='0'>"._GUEST_."</option>\n"; }
                if (
$f_auth_view==1) { echo "<option value='1' selected>"._USER_."</option>\n"; } else { echo "<option value='1'>"._USER_."</option>\n"; }
                if (
$f_auth_view==2) { echo "<option value='2' selected>"._MODERATOR_."</option>\n"; } else { echo "<option value='2'>"._MODERATOR_."</option>\n"; }
                if (
$f_auth_view==3) { echo "<option value='3' selected>"._ADMIN_."</option>\n"; } else { echo "<option value='3'>"._ADMIN_."</option>\n"; }
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._AUTH_READ_."</b></td><td>";
                echo 
"<select name='auth_read'>\n";
                if (
$f_auth_read==0) { echo "<option value='0' selected>"._GUEST_."</option>\n"; } else { echo "<option value='0'>"._GUEST_."</option>\n"; }
                if (
$f_auth_read==1) { echo "<option value='1' selected>"._USER_."</option>\n"; } else { echo "<option value='1'>"._USER_."</option>\n"; }
                if (
$f_auth_read==2) { echo "<option value='2' selected>"._MODERATOR_."</option>\n"; } else { echo "<option value='2'>"._MODERATOR_."</option>\n"; }
                if (
$f_auth_read==3) { echo "<option value='3' selected>"._ADMIN_."</option>\n"; } else { echo "<option value='3'>"._ADMIN_."</option>\n"; }
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._AUTH_WRITE_."</b></td><td>";
                echo 
"<select name='auth_write'>\n";
                if (
$f_auth_write==0) { echo "<option value='0' selected>"._GUEST_."</option>\n"; } else { echo "<option value='0'>"._GUEST_."</option>\n"; }
                if (
$f_auth_write==1) { echo "<option value='1' selected>"._USER_."</option>\n"; } else { echo "<option value='1'>"._USER_."</option>\n"; }
                if (
$f_auth_write==2) { echo "<option value='2' selected>"._MODERATOR_."</option>\n"; } else { echo "<option value='2'>"._MODERATOR_."</option>\n"; }
                if (
$f_auth_write==3) { echo "<option value='3' selected>"._ADMIN_."</option>\n"; } else { echo "<option value='3'>"._ADMIN_."</option>\n"; }
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._AUTH_DELETE_."</b></td><td>";
                echo 
"<select name='auth_delete'>\n";
                if (
$f_auth_delete==0) { echo "<option value='0' selected>"._GUEST_."</option>\n"; } else { echo "<option value='0'>"._GUEST_."</option>\n"; }
                if (
$f_auth_delete==1) { echo "<option value='1' selected>"._USER_."</option>\n"; } else { echo "<option value='1'>"._USER_."</option>\n"; }
                if (
$f_auth_delete==2) { echo "<option value='2' selected>"._MODERATOR_."</option>\n"; } else { echo "<option value='2'>"._MODERATOR_."</option>\n"; }
                if (
$f_auth_delete==3) { echo "<option value='3' selected>"._ADMIN_."</option>\n"; } else { echo "<option value='3'>"._ADMIN_."</option>\n"; }
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._POSITION_."</b></td><td><input type='text' name='position' value=\"$f_position\" size='5' maxlength='255'></td></tr>\n";
            echo 
"<tr><td><b>"._STATUS_."</b></td><td>";
                echo 
"<select name='status'>\n";
                    if (
$f_status==1) {
                        echo 
"<option value='1' selected>"._OPEN_."</option>\n";
                        echo 
"<option value='0'>"._CLOSED_."</option>\n";
                    } else {
                        echo 
"<option value='1'>"._OPEN_."</option>\n";
                        echo 
"<option value='0' selected>"._CLOSED_."</option>\n";
                    }
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<td colspan='2'><input type='submit' name='Submit' value='"._MODIFY_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>";
    } else {
        
$save true;
        if (
$name=="") { $save false; }
    
        if (
$save) {
            
$dblink->query("UPDATE memht_forum_forums SET parent='$parent',category='$category',name='$name',description='$description',position='$position',auth_view='$auth_view',auth_read='$auth_read',auth_write='$auth_write',auth_delete='$auth_delete',status='$status' WHERE id='$id'");
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=forum'>";
        } else {
            echo 
"<div align='center' id='errorText'><b>"._FIELDINVALID_."</b></div>";
        }
    }
}

function 
deleteForum($id,$ok=false) {
    global 
$dblink;
    
    
$id intval($id);
    if (
$ok) {
        
$dblink->query("DELETE FROM memht_forum_forums WHERE id='$id'");
        
$dblink->query("DELETE FROM memht_forum_posts WHERE forum='$id'");
        echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=forum'>";        
    } else {
        echo 
"<div align='center'><b>"._SUREDELETEFORUM_."</b><br><a href='admin.php?page=forum&op=deleteForum&id=$id&ok=true' title='"._YES_."'>"._YES_."</a> - <a href='admin.php?page=forum' title='"._NO_."'>"._NO_."</a></div>";
    }
}

function 
addCategory($name,$description,$ok=false) {
    global 
$dblink;
    
    if (!
$ok) {
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='form_cat' method='post' action='admin.php?page=forum&op=addCat&ok=true'>";
            echo 
"<tr><td><b>"._CATEGORYNAME_."</b><td><input type='text' name='name' size='40' maxlength='255'>\n";
            echo 
"<tr><td valign='top'><b>"._DESCRIPTION_."</b></td><td>\n";
                
textarea("description","100%","200px",1,"fulladmin");
            echo 
"</td></tr><tr><td colspan='2'><input type='submit' name='Submit' value='"._ADD_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>";
    } else {
        
$save true;
        if (
$name=="") { $save false; }
    
        if (
$save) {
            
$lastrow $dblink->get_row("SELECT * FROM memht_forum_categories ORDER BY id DESC LIMIT 1");
            
$newpos intval($lastrow['position']);
            
$newpos++;            
            
$dblink->query("INSERT INTO memht_forum_categories (id,name,description,position)
                            VALUES (null,'$name','$description','$newpos')"
);
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=forum'>";
        } else {
            echo 
"<div align='center' id='errorText'><b>"._FIELDINVALID_."</b></div>";
        }
    }
}

function 
editCategory($id,$name,$description,$position,$ok=false) {
    global 
$dblink;
    
    
$id intval($id);

    
$row $dblink->get_row("SELECT * FROM memht_forum_categories WHERE id='$id'");
    
$dbname outCode($row['name']);
    
$dbdescription outCode($row['description']);
    
$dbposition intval($row['position']);

    if (!
$ok) {
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='form_cat' method='post' action='admin.php?page=forum&op=editCat&id=$id&ok=true'>";
            echo 
"<tr><td><b>"._CATEGORYNAME_."</b><td><input type='text' name='name' value=\"$dbname\" size='40' maxlength='255'></td></tr>\n";
            echo 
"<tr><td valign='top'><b>"._DESCRIPTION_."</b></td><td>\n";
                
textarea("description","100%","200px",1,"fulladmin",$dbdescription);
            echo 
"</td></tr>\n";
        echo 
"<tr><td>"._POSITION_."</td><td><input type='text' name='position' value=\"$dbposition\" size='5' maxlength='255'></td></tr>\n";    
        echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._MODIFY_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>";
    } else {
        
$save true;
        if (
$name=="") { $save false; }
    
        if (
$save) {    
            
$dblink->query("UPDATE memht_forum_categories SET name='$name',description='$description',position='$position' WHERE id='$id'");
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=forum'>";
        } else {
            echo 
"<div align='center' id='errorText'><b>"._FIELDINVALID_."</b></div>";
        }
    }
}

function 
deleteCategory($id,$ok=false) {
    global 
$dblink;
    
    
$id intval($id);
    if (
$ok) {
        
$dblink->query("DELETE FROM memht_forum_categories WHERE id='$id'");
        echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=forum'>";        
    } else {
        echo 
"<div align='center'><b>"._SUREDELETECATEGORY_."</b><br><a href='admin.php?page=forum&op=deleteCat&id=$id&ok=true' title='"._YES_."'>"._YES_."</a> - <a href='admin.php?page=forum' title='"._NO_."'>"._NO_."</a></div>";
    }
}

function 
changeStatus($id) {
    global 
$dblink;
    
    
$id intval($id);
    
    
$row_stat $dblink->get_row("SELECT * FROM memht_forum_forums WHERE id='$id'");
    
$status intval($row_stat['status']);
    
    
$newStatus = ($status==1) ? ;

    
$dblink->query("UPDATE memht_forum_forums SET status='$newStatus' WHERE id='$id'");
    echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=forum'>";
}


function 
moderators($id,$subop,$ok=false) {
    global 
$dblink;

    if (isset(
$_GET['fid'])) { $fid intval($_GET['fid']); } else { $fid 0; }
    if (isset(
$_REQUEST['gid'])) { $gid intval($_REQUEST['gid']); } else { $gid 0; }
    
    switch (
$subop) {
        case 
"addGroup":
            if (!
$ok) {
                echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
                echo 
"<form name='form_modg' method='post' action='admin.php?page=forum&op=moderators&subop=addGroup&fid=$fid&ok=true'>";
                    echo 
"<tr><td width='25%'><b>"._GROUP_."</b></td><td>\n";
                        echo 
"<select name='gid'>\n";
                            
$result $dblink->get_list("SELECT * FROM memht_groups ORDER BY name");
                            foreach (
$result as $row) {
                                
$groupid intval($row['id']);
                                
$groupname outCode($row['name']);
                                
                                echo 
"<option value='$groupid'>$groupname</option>\n";
                            }
                        echo 
"</select>\n";
                    echo 
"</td></tr>\n";
                    echo 
"</td></tr><tr><td colspan='2'><input type='submit' name='Submit' value='"._ADD_."'>\n";
                echo 
"</form>\n";
                echo 
"</table>";
            } else {
                
$save true;
                if (
$fid==0) { $save false$msg _FORUM_." ".strtolower(_FIELD_)." ".strtolower(_REQUIRED_); }
                if (
$gid==0) { $save false$msg _GROUP_." ".strtolower(_FIELD_)." ".strtolower(_REQUIRED_); }
            
                if (
$save) {
                    
$dblink->query("INSERT INTO memht_forum_moderation (forum,groupid) VALUES ('$fid','$gid')");
                    echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=forum&op=moderators'>";
                } else {
                    echo 
"<div align='center' id='errorText'><b>$msg</b></div>";
                }
            }
        break;
        
        case 
"deleteGroup":
            if (
$ok) {
                
$dblink->query("DELETE FROM memht_forum_moderation WHERE forum=$fid AND groupid=$gid");
                echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=forum&op=moderators'>";        
            } else {
                echo 
"<div align='center'><b>"._SUREDELETE_."</b><br><a href='admin.php?page=forum&op=moderators&subop=deleteGroup&fid=$fid&gid=$gid&ok=true' title='"._YES_."'>"._YES_."</a> - <a href='admin.php?page=forum&op=moderators' title='"._NO_."'>"._NO_."</a></div>";
            }
        break;
        
        case 
"forumList":
        default:
            
$n 0;
            echo 
"<table width='100%' align='center' cellspacing='1' cellpadding='0' class='std_nicetable'>";
            
$result $dblink->get_list("SELECT * FROM memht_forum_categories ORDER BY position");
            foreach (
$result as $row) {
                
$c_id intval($row['id']);
                
$c_name outCode($row['name']);
                echo 
"<thead>\n";
                echo 
"<tr><td><b>$c_name</b></td></tr>\n";
                echo 
"</thead>\n";
                echo 
"<tbody>\n";
                
$n 0;
                
$result $dblink->get_list("SELECT * FROM memht_forum_forums WHERE category=$c_id AND parent=0 ORDER BY position");
                foreach (
$result as $row) {
                    
$f_id intval($row['id']);
                    
$f_name outCode($row['name']);
                                    
                    
$class = (($n++%2)!=0) ? "hlight" "clean" ;
                    
                    echo 
"<tr><td class='$class'><b>$f_name</b> <a href='admin.php?page=forum&op=moderators&subop=addGroup&fid=$f_id' title='"._ADD_GROUP_."'><img src='images/plus.gif' alt='+' border='0'></a>";
                    
$mresult $dblink->get_list("SELECT m.groupid,g.name FROM memht_forum_moderation AS m JOIN memht_groups AS g ON m.groupid=g.id WHERE m.forum=$f_id");
                    foreach (
$mresult as $mrow) {
                        echo 
"<div>&nbsp;&nbsp;&nbsp;&nbsp;- <a href='http://www.memht.com/admin.php?page=groups&op=showGroup&id=".intval($mrow['groupid'])."' title=\"".outCode($mrow['name'])."\">".outCode($mrow['name'])."</a> <a href='admin.php?page=forum&op=moderators&subop=deleteGroup&fid=$f_id&gid=".intval($mrow['groupid'])."' title='"._DELETE_."'><img src='images/minus.gif' alt='-' border='0'></a></div>";
                    }
                    echo 
"</td></tr>\n";
                }
                echo 
"</tbody>\n";
            }
            echo 
"</table>";
        break;    
    }
}

function 
smiles($subop,$ok=false) {
    global 
$dblink;

    
$title = (isset($_POST['title'])) ? inCode($_POST['title']) : ((isset($_GET['title'])) ? inCode($_GET['title']) : "" ) ;
    
$img = (isset($_POST['img'])) ? inCode($_POST['img']) : "" ;
    
$code = (isset($_POST['code'])) ? inCode($_POST['code']) : "" ;
    
    echo 
"<div align='center' class='box'>";
            echo 
"<a href='admin.php?page=forum&op=smiles' title='"._LIST_."'><img src='admin/icons/list.png' border='0' title='"._LIST_."' align='top'> "._LIST_."</a>";
            echo 
" - <a href='admin.php?page=forum&op=smiles&subop=addSmile' title='"._ADD_."'><img src='admin/icons/add.png' border='0' title='"._ADD_."' align='top'> "._ADD_."</a>";
    echo 
"</div>";
    
    switch (
$subop) {
        case 
"addSmile":
            if (!
$ok) {
                echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
                echo 
"<form name='form' method='post' action='admin.php?page=forum&op=smiles&subop=addSmile&ok=true'>";
                    echo 
"<tr><td><b>"._TITLE_."</b><td><input type='text' name='title' size='30' maxlength='255'></td></tr>\n";
                    echo 
"<tr><td><b>"._IMAGE_."</b><td><select name='img' onChange=\"document.form.smilepw.src = 'images/smiles/'+this.options[this.selectedIndex].value;\">\n";
                        
$filearray getDirContent("images/smiles/");
                        foreach(
$filearray as $file) {
                            echo 
"<option value='$file'>$file</option>\n";
                        }
                    echo 
"</select> <img src='' name='smilepw'></td></tr>\n";
                    echo 
"<tr><td><b>"._CODE_."</b><td><input type='text' name='code' size='20' maxlength='255'></td></tr>\n";
                echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._ADD_."'>\n";
                echo 
"</form>\n";
                echo 
"</table>";
            } else {
                
$save true;
                if (
$title=="") { $save false; }
                if (
$img=="") { $save false; }
                if (
$code=="") { $save false; }
        
                if (
$save) {    
                    
$dblink->query("INSERT INTO memht_smiles (title,img,code)
                                    VALUES ('$title','$img','$code')"
);
                    echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=forum&op=smiles'>";
                } else {
                    echo 
"<div align='center' id='errorText'><b>"._FIELDINVALID_."</b></div>";
                }
            }
        break;
        
        case 
"edit":
            if (!
$ok) {
                
$row $dblink->get_row("SELECT * FROM memht_smiles WHERE title='$title'");
                
$img outCode($row['img']);
                
$code outCode($row['code']);
                
                echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
                echo 
"<form name='form' method='post' action='admin.php?page=forum&op=smiles&subop=edit&etitle=$title&ok=true'>";
                    echo 
"<tr><td><b>"._TITLE_."</b><td><input type='text' name='title' value=\"$title\" size='30' maxlength='255'></td></tr>\n";
                    echo 
"<tr><td><b>"._IMAGE_."</b><td><select name='img' onChange=\"document.form.smilepw.src = 'images/smiles/'+this.options[this.selectedIndex].value;\">\n";
                        
$filearray getDirContent("images/smiles/");
                        foreach(
$filearray as $file) {
                            
$selected = ($img==$file) ? " selected" "" ;
                            echo 
"<option value='$file'$selected>$file</option>\n";
                        }
                    echo 
"</select> <img src='images/smiles/$img' name='smilepw'></td></tr>\n";
                    echo 
"<tr><td><b>"._CODE_."</b><td><input type='text' name='code' value=\"$code\" size='20' maxlength='255'></td></tr>\n";
                echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._MODIFY_."'>\n";
                echo 
"</form>\n";
                echo 
"</table>";
            } else {
                
$save true;
                if (
$title=="") { $save false; }
                if (
$img=="") { $save false; }
                if (
$code=="") { $save false; }
                
                
$etitle = (isset($_GET['etitle'])) ? inCode($_GET['etitle']) : "" ;
                
                if (
$save) {    
                    
$dblink->query("UPDATE memht_smiles SET title='$title',img='$img',code='$code' WHERE title='$etitle'");
                    echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=forum&op=smiles'>";
                } else {
                    echo 
"<div align='center' id='errorText'><b>"._FIELDINVALID_."</b></div>";
                }
            }
        break;
        
        case 
"delete":
            if (
$ok) {
                
$dblink->query("DELETE FROM memht_smiles WHERE title='$title'");
                echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=forum&op=smiles'>";        
            } else {
                echo 
"<div align='center'><b>"._SUREDELETE_."</b><br><a href='admin.php?page=forum&op=smiles&subop=delete&title=$title&ok=true' title='"._YES_."'>"._YES_."</a> - <a href='admin.php?page=forum&op=smiles' title='"._NO_."'>"._NO_."</a></div>";
            }
        break;
        
        case 
"smilesList":
        default:
            
$n 0;
            echo 
"<table width='100%' align='center' cellspacing='1' cellpadding='0' class='std_nicetable'>";
            echo 
"<thead>\n";
            echo 
"<tr><td><b>"._TITLE_."</b></td><td><b>"._IMAGE_."</b></td><td><b>"._CODE_."</b></td><td width='1%'>&nbsp;</td></tr>\n";
            echo 
"</thead>\n";
            echo 
"<tbody>\n";
            
$result $dblink->get_list("SELECT * FROM memht_smiles");
            foreach (
$result as $row) {
                
$title inCode($row['title']);
                
$img inCode($row['img']);
                
$code inCode($row['code']);
                
                
$class = (($n++%2)!=0) ? "hlight" "clean" ;
                
                echo 
"<tr><td class='$class'><b>$title</b></td><td class='$class'><img src='images/smiles/$img'></td><td class='$class'>$code</td><td class='$class' align='right' nowrap><a href='admin.php?page=forum&op=smiles&subop=edit&title=$title' title='"._MODIFY_."'><img src='images/edit.gif' alt='Edit' border='0'></a> <a href='admin.php?page=forum&op=smiles&subop=delete&title=$title' title='"._DELETE_."'><img src='images/delete.gif' alt='Delete' border='0'></a></td></tr>\n";
            }
            echo 
"</tbody>\n";
            echo 
"</table>";
        break;    
    }
}

function 
titles($subop,$ok=false) {
    global 
$dblink;

    
$title = (isset($_POST['title'])) ? urldecode(inCode($_POST['title'])) : ((isset($_GET['title'])) ? urldecode(inCode($_GET['title'])) : "" ) ;
    
$from = (isset($_POST['from'])) ? intval($_POST['from']) : ;
    
$to = (isset($_POST['to'])) ? intval($_POST['to']) : ;
    
    echo 
"<div align='center' class='box'>";
            echo 
"<a href='admin.php?page=forum&op=titles' title='"._LIST_."'><img src='admin/icons/list.png' border='0' title='"._LIST_."' align='top'> "._LIST_."</a>";
            echo 
" - <a href='admin.php?page=forum&op=titles&subop=addTitle' title='"._ADD_."'><img src='admin/icons/add.png' border='0' title='"._ADD_."' align='top'> "._ADD_."</a>";
    echo 
"</div>";
    
    switch (
$subop) {
        case 
"addTitle":
            if (!
$ok) {
                echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
                echo 
"<form name='form' method='post' action='admin.php?page=forum&op=titles&subop=addTitle&ok=true'>";
                    echo 
"<tr><td><b>"._TITLE_."</b></td><td><input type='text' name='title' size='30' maxlength='255'></td></tr>\n";
                    echo 
"<tr><td><b>"._FROM_."</b></td><td><input type='text' name='from' size='10' maxlength='255'> "._POSTS_."</td></tr>\n";
                    echo 
"<tr><td><b>"._TO_."</b></td><td><input type='text' name='to' size='10' maxlength='255'> "._POSTS_."</td></tr>\n";
                echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._ADD_."'>\n";
                echo 
"</form>\n";
                echo 
"</table>";
            } else {
                
$save true;
                if (
$title=="") { $save false; }
                if (
$to<=$from) { $save false; }
        
                if (
$save) {    
                    
$dblink->query("INSERT INTO memht_forum_titles (title,min,max)
                                    VALUES ('$title','$from','$to')"
);
                    echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=forum&op=titles'>";
                } else {
                    echo 
"<div align='center' id='errorText'><b>"._FIELDINVALID_."</b></div>";
                }
            }
        break;
        
        case 
"edit":
            if (!
$ok) {
                
$row $dblink->get_row("SELECT * FROM memht_forum_titles WHERE title='$title'");
                
$from intval($row['min']);
                
$to intval($row['max']);
                
                echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
                echo 
"<form name='form' method='post' action='admin.php?page=forum&op=titles&subop=edit&etitle=".urlencode($title)."&ok=true'>";
                    echo 
"<tr><td><b>"._TITLE_."</b><td><input type='text' name='title' value=\"$title\" size='30' maxlength='255'></td></tr>\n";
                    echo 
"<tr><td><b>"._FROM_."</b></td><td><input type='text' name='from' value=\"$from\" size='10' maxlength='255'> "._POSTS_."</td></tr>\n";
                    echo 
"<tr><td><b>"._TO_."</b></td><td><input type='text' name='to' value=\"$to\" size='10' maxlength='255'> "._POSTS_."</td></tr>\n";
                echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._MODIFY_."'>\n";
                echo 
"</form>\n";
                echo 
"</table>";
            } else {
                
$save true;
                if (
$title=="") { $save false; }
                if (
$to<=$from) { $save false; }
                
                
$etitle = (isset($_GET['etitle'])) ? urldecode(inCode($_GET['etitle'])) : "" ;
                
                if (
$save) {    
                    
$dblink->query("UPDATE memht_forum_titles SET title='$title',min='$from',max='$to' WHERE title='$etitle'");
                    echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=forum&op=titles'>";
                } else {
                    echo 
"<div align='center' id='errorText'><b>"._FIELDINVALID_."</b></div>";
                }
            }
        break;
        
        case 
"delete":
            if (
$ok) {
                
$dblink->query("DELETE FROM memht_forum_titles WHERE title='$title'");
                echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=forum&op=titles'>";        
            } else {
                echo 
"<div align='center'><b>"._SUREDELETE_."</b><br><a href='admin.php?page=forum&op=titles&subop=delete&title=".urlencode($title)."&ok=true' title='"._YES_."'>"._YES_."</a> - <a href='admin.php?page=forum&op=titles' title='"._NO_."'>"._NO_."</a></div>";
            }
        break;
        
        case 
"titlesList":
        default:
            
$n 0;
            echo 
"<table width='100%' align='center' cellspacing='1' cellpadding='0' class='std_nicetable'>";
            echo 
"<thead>\n";
            echo 
"<tr><td><b>"._TITLE_."</b></td><td><b>"._FROM_."</b></td><td><b>"._TO_."</b></td><td width='1%'>&nbsp;</td></tr>\n";
            echo 
"</thead>\n";
            echo 
"<tbody>\n";
            
$result $dblink->get_list("SELECT * FROM memht_forum_titles");
            foreach (
$result as $row) {
                
$title inCode($row['title']);
                
$from intval($row['min']);
                
$to intval($row['max']);
                
                
$class = (($n++%2)!=0) ? "hlight" "clean" ;
                
                echo 
"<tr><td class='$class'><b>$title</b></td><td class='$class'>$from</td><td class='$class'>$to</td><td class='$class' align='right' nowrap><a href='admin.php?page=forum&op=titles&subop=edit&title=".urlencode($title)."' title='"._MODIFY_."'><img src='images/edit.gif' alt='Edit' border='0'></a> <a href='admin.php?page=forum&op=titles&subop=delete&title=".urlencode($title)."' title='"._DELETE_."'><img src='images/delete.gif' alt='Delete' border='0'></a></td></tr>\n";
            }
            echo 
"</tbody>\n";
            echo 
"</table>";
        break;    
    }
}


require_once(
"admin/inc/inc_header.php");
    
admin_page_title($page);
                    
    
openTable();
        echo 
"<div align='center' class='box'>";
            echo 
"<a href='admin.php?page=forum' title='"._MAIN_."'><img src='admin/icons/list.png' border='0' title='"._MAIN_."' align='top'> "._MAIN_."</a>";
            echo 
" - <a href='admin.php?page=forum&op=addForum' title='"._ADD_FORUM_."'><img src='admin/icons/add.png' border='0' title='"._ADD_FORUM_."' align='top'> "._ADD_FORUM_."</a>";
            echo 
" - <a href='admin.php?page=forum&op=addCat' title='"._ADD_CATEGORY_."'><img src='admin/icons/addcategory.png' border='0' title='"._ADD_CATEGORY_."' align='top'> "._ADD_CATEGORY_."</a>";
            echo 
" - <a href='admin.php?page=forum&op=moderators' title='"._MODERATORS_."'><img src='admin/icons/security.png' border='0' title='"._MODERATORS_."' align='top'> "._MODERATORS_."</a>";
            echo 
" - <a href='admin.php?page=forum&op=smiles' title='"._SMILES_."'><img src='admin/icons/messagebox.png' border='0' title='"._SMILES_."' align='top'> "._SMILES_."</a>";
            echo 
" - <a href='admin.php?page=forum&op=titles' title='"._TITLES_."'><img src='admin/icons/users.png' border='0' title='"._TITLES_."' align='top'> "._TITLES_."</a>";        
        echo 
"</div>";
    
closeTable();
    
    
openTable();
    
        switch(
$op) {
            case 
"addForum":
                
addForum($category,$parent,$name,$description,$auth_view,$auth_read,$auth_write,$auth_delete,$status,$ok);
            break;
            
            case 
"editForum":
                
editForum($id,$category,$parent,$name,$description,$auth_view,$auth_read,$auth_write,$auth_delete,$position,$status,$ok);
            break;
            
            case 
"deleteForum":
                
deleteForum($id,$ok);
            break;
            
            case 
"addCat":
                
addCategory($name,$description,$ok);
            break;
            
            case 
"editCat":
                
editCategory($id,$name,$description,$position,$ok);
            break;
            
            case 
"deleteCat":
                
deleteCategory($id,$ok);
            break;
            
            case 
"switch":
                
changeStatus($id);
            break;
            
            case 
"moderators":
                
moderators($id,$subop,$ok);
            break;
            
            case 
"smiles":
                
smiles($subop,$ok);
            break;
            
            case 
"titles":
                
titles($subop,$ok);
            break;
        
            case 
"fmain":
            default:
                
fmain();
            break;
        }
    
    
closeTable();
require_once(
"admin/inc/inc_footer.php");

?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0201 ]--