!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis2222/application/views/esa/   drwxr-xr-x
Free 50.65 GB of 127.8 GB (39.63%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     v_attend.php (18.5 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<link rel="stylesheet" href="<?=base_url();?>/js/textboxlist_proto/textboxlist2.css" type="text/css" media="screen" title="Test Stylesheet" charset="utf-8" />
<script src="<?=base_url();?>/js/textboxlist_proto/protoculous-effects-shrinkvars.js" type="text/javascript" charset="utf-8"></script>
<script src="<?=base_url();?>/js/textboxlist_proto/textboxlist.js" type="text/javascript" charset="utf-8"></script>
<script src="<?=base_url();?>/js/textboxlist_proto/textboxlistauto.js" type="text/javascript" charset="utf-8"></script>
<?$row_mb = isset($qu_mb) ? $qu_mb->row() : NULL;?>
<script type="text/javascript">
document.observe('dom:loaded', function() {
  // init
    tlist1 = new FacebookList('wk11_co', 'wk11_auto');
//    var type = jQuery("#type").val();
//    if ((type == 1) || (type == 2)) {
        var get_user_list_url = "<?php echo site_url($this->config->item('sa_folder').'search/get_std_list')?>";
//    } else if ((type == 3) || (type == 4)) {
//        var dpj_id = jQuery("#mb_mpj_id").val();
//        var acp_id = jQuery("#mb_acp_id").val();
//        if (acp_id) {
//            dpj_id = acp_id;
//        }
//        var get_user_list_url = "<?php echo site_url($this->config->item('sa_folder').'search/get_tgstd_list/')?>" + dpj_id;
//    }
  // fetch and feed
    new Ajax.Request(get_user_list_url, {
    onSuccess: function(transport) {
        transport.responseText.evalJSON(true).each(function(t){tlist1.autoFeed(t)});
    }
    });
});

Element.addMethods({
    onBoxDispose: function(item,obj) { obj.autoFeed(item.retrieveData('text')); },
    onInputFocus: function(el,obj) { obj.autoShow(); },    
    onInputBlur: function(el,obj) { 
      obj.lastinput = el;
      obj.blurhide = obj.autoHide.bind(obj).delay(0.1);
    },
    filter:function(D,E){var C=[];for(var B=0,A=this.length;B<A;B++){if(D.call(E,this[B],B,this)){C.push(this[B]);}}return C;}
});

function do_submit (action) {
    if (action) {
        jQuery("#myform").attr('action', action);
    }

    var mb_id = jQuery("#mb_id").val();
    if (mb_id == '') {
        tlist1.update();
    }

    jQuery("#myform").submit();
}

var mb_acp_id = "<?echo getval('mb_acp_id'$row_mb);?>";

jQuery(document).ready(function(){
    jQuery(".choice").attr("disabled","disabled");
    jQuery("#cur_id").attr("disabled","disabled");
    //jQuery("#sy_id").attr("disabled","disabled");
    jQuery("#cs2").find(":input").attr("disabled","disabled");
    jQuery("#popup").hide();
    jQuery(".choice").change(function(){
        var type = jQuery("#type").val();
        var val = parseInt(jQuery(this).val());
        
        if (val == 1) {
            jQuery("#popup").hide();
            jQuery("#cs").find(":input").attr("disabled","disabled");
            jQuery("#cs2").find(":input").attr("disabled","disabled");
        } else if(val == 3){
            jQuery("#popup").hide();
            jQuery("#cs2").find(":input").attr("disabled","");
            jQuery("#cs").find(":input").attr("disabled","disabled");
        }else{
            jQuery("#popup").show();
            jQuery("#cs").find(":input").attr("disabled","");
            jQuery("#cs2").find(":input").attr("disabled","disabled");
        }
    });
    jQuery(":input[class^='req']").bind('change',function(){
        var flag = chk_req();
        var type = jQuery("#type").val();
        if (flag)
        {
            if(type<=2){
                jQuery("#choice1").attr("disabled","");
                jQuery("#choice2").attr("disabled","");
            }else if (
                jQuery("#mb_id").val() == ""){
                jQuery(".choice").attr("disabled","");
            }else{
                jQuery("#choice1").attr("disabled","");
            }
            jQuery(".choice").each(function(){
                if(jQuery(this).attr("checked")){
                    jQuery(this).trigger("change");
                }
            });
        }
        else
        {
            jQuery(".choice").attr("disabled","disabled");
            jQuery("#cs").find(":input").attr("disabled","disabled");
            jQuery("#cs2").find(":input").attr("disabled","disabled");
        }
        
        return;
    });

    jQuery("#type").trigger("change");
    //change_type();
});
function chk_req()
{
    var val = parseInt(jQuery("#type").val());
    var flag = true;
    jQuery(".choice").attr("disabled","disabled");
    jQuery(":input[class^='req-']").each(function(){
        if (val == 4) {
            if ((jQuery(this).attr("class")).substring(4) > 2 && jQuery(this).val() == '')
                flag =false;
        } else {
            if ((jQuery(this).attr("class")).substring(4) == val && jQuery(this).val() == '')
                flag = false;
        }
    });
    if (!/^[1-9][0-9]{3}/.test(jQuery(".require-year").val())){
        flag = false;
    }
    jQuery(".require").each(function(){
        if(jQuery(this).val() == ""){
            flag = false;
        }
    });
    return (val && flag);
}
function change_type (obj) {
    var val = parseInt(jQuery(obj).val());
    jQuery("#choice1").attr("checked","");
    jQuery(":input[class^='req-']").each(function(){
        var obj = jQuery(this);
        var id = (obj.attr('class')).substring(4);
        obj.attr("disabled","disabled");
        if(val < 4 ) 
        {
            if( id != val)
                obj.val("");
        }
        else
        {
            if(id < 3)
                obj.val("");
        }
    });
    jQuery(".choice").attr("disabled","disabled");
    jQuery("#cs").find(":input").attr("disabled","disabled");
    //jQuery("#cs2").find(":input").attr("disabled","disabled");
    jQuery("#cur_id").attr("disabled","disabled");
    //jQuery("#sy_id").attr("disabled","disabled");
    switch (val)
    {
    case 1:
    case 2:
        jQuery(":input[class='req-"+val+"']").attr("disabled","");
        mpj_change_cur();
        break;
    case 3:
        jQuery(":input[class='req-"+val+"']").attr("disabled","");
        jQuery(":input[class='req-3']").bind("change",mpj_change_cur);
        break;
    case 4:
        //jQuery(":input[class='req-3']").attr("disabled","").bind("change",change_mpj);
        jQuery(":input[class='req-3']").attr("disabled","");
        jQuery(":input[class='req-4']").attr("disabled","");
        
        jQuery(":input[class='req-3']").change( function() {
            change_mpj();
        });
        
        break;
    }
    jQuery(":input[class^='req-']").trigger("change");
    return;
}

function change_mpj () {
    var mpj_id = jQuery("#mb_mpj_id").val();
    var url = "<?php echo site_url($this->config->item('sa_folder'));?>/attend/get_acp/"+mpj_id;
    if(jQuery("#type").val() != "4")
        return false;
    xmlhttp = newXmlHttp();
    xmlhttp.open("GET", url, false);
    xmlhttp.send(null); 
    if (xmlhttp.readyState==4 && xmlhttp.status==200) {
        var ret_text = xmlhttp.responseText;
        document.getElementById('show_acp').innerHTML= ret_text;
        if (mb_acp_id != "") {
            jQuery(":input[class='req-4']").val(mb_acp_id);
        }
    }
}

function mpj_change_cur () {
    //mpj_change_smo();
    var mpj_id = jQuery("#mb_mpj_id").val();

    var url = "<?php echo site_url($this->config->item('sa_folder'));?>/attend/get_cur/"+mpj_id;

    xmlhttp = newXmlHttp();
    xmlhttp.open("GET", url, false);
    xmlhttp.send(null); 
    if (xmlhttp.readyState==4 && xmlhttp.status==200) {
        var ret_text = xmlhttp.responseText;
        document.getElementById('show_cur').innerHTML= ret_text;
    }
/*
    var url = "<?php echo site_url($this->config->item('sa_folder'));?>/attend/get_sy/"+mpj_id;

    xmlhttp = newXmlHttp();
    xmlhttp.open("GET", url, false);
    xmlhttp.send(null); 
    if (xmlhttp.readyState==4 && xmlhttp.status==200) {
        var ret_text = xmlhttp.responseText;
        document.getElementById('show_sy').innerHTML= ret_text;
    }*/
    var type = jQuery("#type").val();
    if(chk_req())
    {
        if(type<=2){
            jQuery("#choice1").attr("disabled","");
            jQuery("#choice2").attr("disabled","");
        }else if (jQuery("#mb_id").val() == "")
            jQuery(".choice").attr("disabled","");
        else
            jQuery("#choice1").attr("disabled","");
        jQuery("#cur_id").attr("disabled","disabled");
    }
    jQuery(".choice").each(function(){
        if(jQuery(this).attr("checked"))
            jQuery(this).trigger("change");
    });
    jQuery("#cs").find(":input").attr("disabled","disabled");

}

function mpj_change_smo () {
    var mpj_id = jQuery("#mb_mpj_id").val();

    var url = "<?php echo site_url($this->config->item('sa_folder'));?>/attend/get_smo/"+mpj_id;

    xmlhttp = newXmlHttp();
    xmlhttp.open("GET", url, false);
    xmlhttp.send(null); 
    if (xmlhttp.readyState==4 && xmlhttp.status==200) {
        var ret_text = xmlhttp.responseText;
        document.getElementById('show_smo').innerHTML= ret_text;
        jQuery("#cs2").find(":input").attr("disabled","disabled");
    }

}

function acp_change_cur() {
    var acp_id = jQuery("#mb_acp_id").val();

    var url = "<?php echo site_url($this->config->item('sa_folder'));?>/attend/get_cur/"+acp_id;
    xmlhttp = newXmlHttp();
    xmlhttp.open("GET", url, false);
    xmlhttp.send(null); 
    if (xmlhttp.readyState==4 && xmlhttp.status==200) {
        var ret_text = xmlhttp.responseText;
        document.getElementById('show_cur').innerHTML= ret_text;
    }
/*
    var url = "<?php echo site_url($this->config->item('sa_folder'));?>/attend/get_sy/"+acp_id;

    xmlhttp = newXmlHttp();
    xmlhttp.open("GET", url, false);
    xmlhttp.send(null); 
    if (xmlhttp.readyState==4 && xmlhttp.status==200) {
        var ret_text = xmlhttp.responseText;
        document.getElementById('show_sy').innerHTML= ret_text;
    } */
    var type = jQuery("#type").val();
    if(chk_req())
    {
        if(type<=2){
            jQuery("#choice1").attr("disabled","");
            jQuery("#choice2").attr("disabled","");
        }else if (jQuery("#mb_id").val() == "")
            jQuery(".choice").attr("disabled","");
        else
            jQuery("#choice1").attr("disabled","");
    }
    jQuery(".choice").each(function(){
        if(jQuery(this).attr("checked"))
            jQuery(this).trigger("change");
    });
    jQuery("#cs").find(":input").attr("disabled","disabled");
    mpj_change_smo();
}

function change_choice () {
    var choice = jQuery("#choice").val();

    if (choice == 2) {
        jQuery("#popup").show();
    } else {
        jQuery("#popup").hide();
    }
}

function change_cur_sy () {
    var frmId = "myform";
    var type = jQuery("#type").val();

    if ((type == 3) || (type == 4)) {
        if (jQuery("#cur_id").val() == "") {
            alert("กรุณาเลือกหลักสูตร");
            jQuery("#cur_id").focus();
            return false;
        }

        if (jQuery("#sy_id").val() == "") {
            alert("กรุณาเลือกชั้นปี");
            jQuery("#sy_id").focus();
            return false;
        }
    }

    jQuery("#myform").attr("action","mb_popup");
    jQuery("#myform").bind('submit',function(){
        window.open('', frmId+"_popup", "width=800,height=400,resizeable=1,scrollbars=1");
        this.target = frmId+"_popup";
    });
    jQuery("#myform").trigger("submit");
}
</script>
<?php

$attributes 
= array('id' => 'myform''name' => 'myform');
echo 
form_open($this->config->item('sa_folder').'attend/mb_insert_update'$attributes);
?>
<table width="80%" align="center">
    <tr>
        <td align="center"><h3>บันทึกประวัติการเข้าร่วมสโมสร/ชมรม/โครงการ/กิจกรรม</h3></td>
    </tr>
    <tr>
        <td>
<table class="szone2" width="100%">
    <tbody>
        <tr class="szone">
            <td>ประเภท</td>
            <td>
<?php
            $js 
"id=\"type\" onChange=\"change_type(this)\"";
            echo 
form_dropdown('type'$rs_type$type$js);
?>
            <span class="error">* <?php echo form_error('type');?></span></td>
        </tr>
        <tr class="szone">
            <td>สโมสร</td>
            <td><select id="mb_smo_id" name="mb_smo_id" class="req-1">
                <option value=""></option>
<?php
                
foreach ($rs_smo->result() as $row_smo) {
                    echo 
"<option value=\"".$row_smo->sc_id."\" ".(($row_smo->sc_id == getval('mb_smo_id'$row_mb)) ? "selected" "").">".$row_smo->sc_name."</option>";
                }
?>
            </select>
            <span class="error">* <?php echo form_error('mb_smo_id');?></span></td>
        </tr>
        <tr class="szone">
            <td>ชมรม</td>
            <td><select id="mb_cl_id" name="mb_cl_id" class="req-2">
                <option value=""></option>
<?php
                
foreach ($rs_cl->result() as $row_cl) {
                    echo 
"<option value=\"".$row_cl->sc_id."\" ".(($row_cl->sc_id == getval('mb_cl_id'$row_mb)) ? "selected" "").">".$row_cl->sc_name."</option>";
                }
?>
            </select>
            <span class="error">* <?php echo form_error('mb_cl_id');?></span></td>
        </tr>
        <tr class="szone">
            <td>โครงการ</td>
            <td><select id="mb_mpj_id" name="mb_mpj_id" class="req-3">
                <option value=""></option>
<?php
                
foreach ($rs_mpj->result() as $row_mpj) {
                    echo 
"<option value=\"".$row_mpj->dpj_id."\" ".(($row_mpj->dpj_id == getval('mb_mpj_id'$row_mb)) ? "selected" "").">".$row_mpj->dpj_sub_name."</option>";
                }
?>
            </select>
            <span class="error">* <?php echo form_error('mb_mpj_id');?></span></td>
        </tr>
        <tr class="szone">
            <td>กิจกรรม</td>
            <td><div id='show_acp'>
            <select id="mb_acp_id" name="mb_acp_id" class="req-4">
                <option value=""></option>
<?php
                
if (isset($rs_acp)) {
                    foreach (
$rs_acp->result() as $row_acp) {
                        echo 
"<option value=\"".$row_acp->dpj_id."\" ".(($row_acp->dpj_id == getval('mb_acp_id'$row_mb)) ? "selected" "").">".$row_acp->dpj_sub_name."</option>";
                    }
                }
                
                
$default_mb_year getval('mb_year'$row_mbgetNowYearTh());
?>
            </select>
            </div>
            <span class="error"><?php echo form_error('mb_acp_id');?></span></td>
        </tr>
        <tr class="szone">
            <td>ปีการศึกษาที่เข้าร่วม</td>
            <td><input type="text" id="mb_year" class="require-year" name="mb_year" value="<?=($mb_year)?$mb_year:$default_mb_year;?>" size="4" maxlength="4" />
            <span class="error">* <?php echo form_error('mb_year');?></span></td>
        </tr>
        <tr class="szone">
            <td>ภาคการศึกษาที่เข้าร่วม</td>
            <td>
<?php
            $js 
"id=\"mb_tmId\" class=\"require\"";
            echo 
form_dropdown('mb_tmId'$rs_tmgetval('mb_tmId'$row_mb$this->session->userdata('tmId')), $js);
?>
            <span class="error">* <?php echo form_error('mb_tmId');?></span></td>
        </tr>
        <tr class="szone">
            <td>ชั้นปีที่เข้าร่วม</td>
            <td>
<?php
            $js 
"id=\"mb_syId\" class=\"require\"";
            echo 
form_dropdown('mb_syId'$rs_sygetval('mb_syId'$row_mb), $js);
?>
            <span class="error">* <?php echo form_error('mb_syId');?></span></td>
        </tr>
        <tr class="szone">
            <td align="left">วันที่เริ่มต้น</td>
            <td align="left"><script>DateInput('mb_fr_date', true, 'DD/MM/YYYY',"<?php echo set_value('mb_fr_date') ? set_value('mb_fr_date') : splitDateDb2(getval('mb_fr_date'$row_mbgetNowDate()), '/');?>");</script>
            <?php echo form_error('mb_fr_date');?></td>
        </tr>
        <tr class="szone">
            <td align="left">วันที่สิ้นสุด</td>
            <td align="left"><script>DateInput('mb_to_date', true, 'DD/MM/YYYY',"<?php echo set_value('mb_to_date') ? set_value('mb_to_date') : splitDateDb2(getval('mb_to_date'$row_mbgetNowDate()), '/');?>");</script>
            <?php echo form_error('mb_to_date');?></td>
        </tr>
        <tr class="szone">
            <td>ผู้เข้าร่วม</td>
            <td align="left"><input type="radio" id="choice1" class="choice" name="choice" value="1" checked /> รหัส/ชื่อ-สกุลนักศึกษา
            <input type="text" id="wk11_co" name="wk11_co" value="" width="500" />
            <div id="wk11_auto">
                <div class="default">กรุณากรอกรหัส/ชื่อ-สกุลนักศึกษา</div>
                <ul class="feed">
<?php
                
if (isset($qu_mb)) {
?>
                <li><?php echo getval('stdCode'$row_mb).': '.getval('stdName'$row_mb).' '.getval('stdSurname'$row_mb);?></li>

                <input type="hidden" id="std" name="std" value="<?php echo getval('stdCode'$row_mb).': '.getval('stdName'$row_mb).' '.getval('stdSurname'$row_mb).'###';?>" />
<?php
                
}
?>
                </ul>
            </div>
            <?php echo form_error('wk11_co');?>
            <br />
            <input type="radio" id="choice2" class="choice" name="choice" value="2" onClick="change_choice()" /> <span id="popup" class="hand" onClick="change_cur_sy()"><?php echo img($this->config->item('sa_image_reply'));?></span>
            หลักสูตร <span id="show_cur">
<?php
            $js 
"id=\"cur_id\"";
            echo 
form_dropdown('cur_id'$rs_cur''$js);
?>
            </span>
            ชั้นปี <span id="show_sy">
<?php        $rs_sy = array(1=>'1',2=>'2',3=>'3',4=>'4');
            
$js "id=\"sy_id\"";
            echo 
form_dropdown('sy_id'$rs_sy''$js);
?>
            </span>
            <span class="error"><?php echo form_error('cur_id') ? form_error('cur_id') : form_error('sy_id');?></span>
            <br />
            <br />
            <input type="radio" id="choice3" class="choice" name="choice" value="3" /><span id="cs2"> สมาชิกสโมสร/ชมรม&nbsp;<span id="show_smo">
            
            <?php
            $js 
"id=\"tg_sc_id\"";
            echo 
form_dropdown('tg_sc_id'$rs_opsmo''$js);
?>
            </span>
            </span>
            </td>
        </tr>
        <tr class="szone2">
            <td colspan="2" align="center"><input type="submit" id="btnSubmit" name="btnSubmit" value="บันทึก" onClick="do_submit()" />
            <input type="button" id="btnSearch" name="btnSearch" value="ค้นหา" onClick="do_submit('<?php echo site_url($this->config->item('sa_folder').'attend/mb_input');?>')" />
            <input type="hidden" id="mb_id" name="mb_id" value="<?php echo getval('mb_id'$row_mb);?>" /></td>
        </tr>
    </tbody>
</table>
        </td>
    </tr>
</table>
<?php echo form_close();?>

<table class="tb_1" width="100%">
    <thead>
        <tr>
            <th>ลำดับ</th>
            <th>รหัสนักศึกษา</th>
            <th>ชื่อ-สกุลนักศึกษา</th>
            <th>สโมสร/ชมรม/โครงการ/กิจกรรม</th>
            <th>ปีการศึกษาที่เข้าร่วม</th>
            <th>ภาคการศึกษาที่เข้าร่วม</th>
            <th>ชั้นปีที่เข้าร่วม</th>
            <th>วันที่เริ่มต้น</th>
            <th>วันที่สิ้นสุด</th>
            <th>แก้ไข</th>
            <th>ลบ</th>
        </tr>
    </thead>
    <tbody>
<?php
        $i 
1;
        if (isset(
$rs_mb)) {
            foreach (
$rs_mb->result() as $row_mb) {
                
//if ($i > 20) break;
?>
        <tr >
            <td height="22" align="center"><?php echo $i;?></td>
            <td align="center"><span class="hand" onClick="sendPost('dtform', {'std_id':<?php echo $row_mb->mb_std_id;?>}, 'profile', {})"><?php echo $row_mb->stdCode;?></span></td>
            <td><?php echo $row_mb->prefixName.$row_mb->stdName.' '.$row_mb->stdSurname;?></td>
            <td><?php echo $row_mb->smo_name.$row_mb->cl_name.$row_mb->mpj_name."<br />".$row_mb->acp_name;?></td>
            <td align="center"><?php echo $row_mb->mb_year;?></td>
            <td align="center"><?php echo $row_mb->mb_tmId;?></td>
            <td align="center"><?php echo $row_mb->mb_syId;?></td>
            <td align="center"><?php echo abbreDate2($row_mb->mb_fr_date);?></td>
            <td align="center"><?php echo abbreDate2($row_mb->mb_to_date);?></td>
            <td align="center"><span class="hand" onClick="sendPost('myform', {'mb_id':<?php echo $row_mb->mb_id;?>}, 'mb_input')"><?php echo img($this->config->item('sa_image_reply'));?></span></td>
            <td align="center"><span class="hand" onClick="if (confirm('ต้องการลบใช่หรือไม่')) { sendPost('hidform', {'mb_id':<?php echo $row_mb->mb_id;?>}, 'mb_delete'); }"><?php echo img($this->config->item('sa_image_del'));?></span></td>
        </tr>
<?php
                $i
++;
            }
        }

        if (
$i == 1) {
?>
        <tr class='notfound'>
            <td colspan="11" align="center"><?php echo $this->config->item('sa_not_found');?></td>
        </tr>
<?php
        
}
?>
    </tbody>
</table><!-- mi -->

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.017 ]--