!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis2222/application/views/eregis/   drwxrwxrwx
Free 50.65 GB of 127.8 GB (39.63%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     v_rptRis119.php (7.27 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
header
('Content-type: application/xls');
header('Content-Disposition: attachment; filename="rptRis119.xls"');
?>
<style>
td
  { white-space: nowrap; margin: 0; }
</style>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<table align="center" border="0" cellpadding="0" cellspacing="1">
<?php
    $cols 
3;
    
// หาเทอม
    
$rs_term $co->qryCourseOpenUnionCourseOpen($curId,$tmcAcY,$stY);

    if (
$rs_term->num_rows()) {
        foreach (
$rs_term->result() as $term) {
            
$term2 $co->qryCourseOpenJoinCourseJoinTermByCurIdAndAcYAndstYAndSe($curId,$tmcAcY,$stY,$term->coTmId);
            
$cols += $term2->num_rows() + 1;
        }
    }
?>
    <tr>
        <td rowspan="2"><img src="<?php echo base_url().$this->config->item('rg_upload_picture').$cfgClgLogo;?>" width="40" height="35" align="absmiddle" border="0" /></td>
        <td colspan="<?php echo $cols;?>"><font size="2"><b><?php echo $cfgClgName;?></b></font></td>
        <td align="right" valign="top" rowspan="2"><font size="2"><b>RIS119</b></font></td>
    </tr>
    <tr>
        <td colspan="<?php echo $cols;?>"><font size="2"><b><?php echo $cfgSiteName;?></b></font></td>
    </tr>
    <tr>
        <td colspan="<?php echo $cols 2;?>"></td>
    </tr>
    <tr>
        <td colspan="<?php echo $cols 2;?>" align="center"><font size="3"><b>รายงานผลการเรียน</b></font></td>
    </tr>
<?php
    
if ($qu_cur->num_rows()) {
        
$row $qu_cur->row();
        
$curName $row->curName;
        
$elvName $row->levelName;
    } else {
        
$curName "";
        
$elvName "";
    }

    if (
$rs_std->num_rows()) {
        
$row $rs_std->row();
        
$genNo $row->genNo;
    } else {
        
$genNo "";
    }
?>
    <tr>
        <td colspan="<?php echo $cols 2;?>" align="center"><font size="2"><b>หลักสูตร</b> <?php echo $curName;?>
        <b>ระดับ</b> <?php echo $elvName;?>
        <b>รุ่น</b> <?php echo $genNo;?></font></td>
    </tr>
    <tr>
        <td colspan="<?php echo $cols 2;?>" align="center"><font size="2"><b>ชั้นปี</b> <?php echo $stY;?>
        <b>ปีการศึกษา</b> <?php echo $tmcAcY;?></font></td>
    </tr>
    <tr>
        <td colspan="<?php echo $cols 2;?>"></td>
    </tr>
    <tr>
        <td colspan="<?php echo $cols 2;?>"><table border="1" cellspacing="0" cellpadding="0" bordercolor="#000000" style="border-collapse: collapse" align="center">
            <tr>
                <td rowspan="2" height="22" align="center"><font size="2"><b>ที่</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>รหัสนักศึกษา</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>ชื่อ-สกุล</b></font></td>
<?php
                
//$rs_term = $co->qryCourseOpenUnionCourseOpen($curId,$tmcAcY,$stY);
                
if($rs_term->num_rows()) {
                    foreach(
$rs_term->result() as $term) {
                        
$term2 $co->qryCourseOpenJoinCourseJoinTermByCurIdAndAcYAndstYAndSe($curId,$tmcAcY,$stY,$term->coTmId);
                        if(
$term2->num_rows()) {
?>
                <td colspan="<?php echo $term2->num_rows()+1;?>" align="center"><font size="2"><b><?php echo $term2->row()->tmName;?></b></font></td>
<?php
                        
}
                    }
                }
?>
                <td rowspan="2" align="center"><font size="2"><b>AYR-GPA</b></font></td>
                <td rowspan="2" align="center"><font size="2"><b>CUM-GPA</b></font></td>
                <!-- <td rowspan="2" align="center"><font size="2"><b>SEM-GPA</b></font></td> -->
            </tr>
            <tr>
<?php
                
//$rs_term = $co->qryCourseOpenUnionCourseOpen($curId,$tmcAcY,$stY);

                
if($rs_term->num_rows()) {
                    foreach(
$rs_term->result() as $term) {

                        
$term2 $co->qryCourseOpenJoinCourseJoinTermByCurIdAndAcYAndstYAndSe($curId,$tmcAcY,$stY,$term->coTmId);
                        if(
$term2->num_rows()) {
                            foreach(
$term2->result() as $row_term2) {
?>
                <td align="center"><font size="2"><b><?php echo $row_term2->crsCode.'<br>'.$row_term2->crsUnit;?></b></font></td>
<?php
                            
}
?>
                <td align="center"><font size="2"><b>SEM-GPA</b></font></td>
<?php
                        
}
                    }
                }
?>
            </tr>
<?php
            $i 
0;
            
//$con_rs_std = array('stdCurId'    => $curId, 'stdAdY' => $acY, 'stdSyId' => $stY);
            //$rs_std = $std->qryStdJoinPfCur($con_rs_std, $ord_rs_std);
            
            
$con_rs_std = array('rgCurId'    => $curId'rgAcY' => $tmcAcY'rgSyId' => $stY);
            
$ord_rs_std = array('stdGPA'    => "DESC""stdTotalPoint" => "DESC");
            
$grp_rs_std = array('stdId');
            
$rs_std $std->qryStdJoinRgPfCur($con_rs_std$ord_rs_std$grp_rs_std);
//echo $std->db->last_query().'<BR>';
            
if($rs_std->num_rows()) {
                foreach(
$rs_std->result() as $row_std) {
?>
             <tr>
                <td align="center"><font size="2"><?php echo $i+1;?></font></td>
                <td align="center"><font size="2"><?php echo $row_std->stdCode;?></font></td>
                <td><font size="2"><?php echo $row_std->prefixName.$row_std->stdName.' '.$row_std->stdSurname;?></font></td>
<?php
                    
//$rs_term = $co->qryCourseOpenUnionCourseOpen($curId,$tmcAcY,$stY);  // ได้เทอม

                    
$max_tmId '';
                    if(
$rs_term->num_rows()) {
                        foreach(
$rs_term->result() as $term) {
                            
$term2 $co->qryCourseOpenJoinCourseJoinTermByCurIdAndAcYAndstYAndSe($curId,$tmcAcY,$stY,$term->coTmId);
                            if(
$term2->num_rows()) {
                                foreach(
$term2->result() as $row_term2) {
                                    
$con_rd_grade = array('rdStdId'    => $row_std->stdId,
                                                          
'rdAcY'    => $tmcAcY,
                                                          
'rdTmId'    => $term->coTmId,
                                                          
'coDeclareStatus'    => 'Y',
                                                          
'coCrsId'    => $row_term2->coCrsId);
                                    
$rd_grade $rd->qryRdJoinCoCrs($con_rd_grade); // หาวิชา + เกรดที่ได้ 
//echo $rd->db->last_query().'<BR>';
                                    
if($rd_grade->num_rows()) {
                                        foreach(
$rd_grade->result() as $row_rd_grade) {
?>
                <td align="center"><font size="2"><?php echo $row_rd_grade->rdGrade;?></font></td>
<?php
                                        
//end foreach
                                    
} else {
?>
                <td align="center"><font size="2"></font></td>
<?php
                                    
}
                                }
                    
// เกรดเฉลี่ยรายเทอม
                    
$ssm->ssmStdId $row_std->stdId;
                    
$ssm->ssmAcY $tmcAcY;
                    
$ssm->ssmTmId $term->coTmId;
                    
$ssm->get_by_key(TRUE);
?>
                <td align="center"><font size="2"><?php echo ($ssm->ssmGPA) ? number_format($ssm->ssmGPA2) : 0;?></font></td>
<?php
                            $max_tmId 
$term->coTmId;
                            }
                        }
                    }
?>
                <td align="center"><font size="2">
<?php
                $divisorAYRGPAX 
$rd->GetAllFDivisorAYRGPAX($row_std->stdId$tmcAcY);
                if (
$divisorAYRGPAX) {
                    echo 
number_format($rd->GetDividendAYRGPA($row_std->stdId$tmcAcY) / $divisorAYRGPAX2);
                } else {
                    echo 
number_format(02);
                }
?>
                </font></td>
                <td align="center"><font size="2">
<?php
                $tmId 
= ($rs_term->num_rows()) ? $rs_term->row()->coTmId '';

                
//$divisorGPAX = $rd->GetAllFDivisorGPAX($row_std->stdId, $tmcAcY, $tmId);
                
$divisorGPAX $rd->GetAllFDivisorGPAX($row_std->stdId$tmcAcY$max_tmId);
                if (
$divisorGPAX) {
                    
//echo number_format($rd->GetDividendGPAX($row_std->stdId, $tmcAcY, $tmId) / $divisorGPAX, 2);

                    
echo number_format($rd->GetDividendGPAX($row_std->stdId$tmcAcY$max_tmId) / $divisorGPAX2);

                } else {
                    echo 
number_format(02);
                }
?>
                </font></td>
            </tr>
<?php
                    $i
++;
                }
            }
?>
        </table></td>
    </tr>
    <tr>
        <td colspan="<?php echo $cols 2;?>"></td>
    </tr>
    <tr valign="top">
        <td colspan="<?php echo $cols 1;?>"><font size="2" >วันที่พิมพ์ : <?php echo date('d-m-y h:m');?></font></td>
        <td align="right"><font size="2">หน้า 1/1</font></td>
    </tr>
</table>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0204 ]--