Zploit 0-Day Shell

:: Editing File: content_process.php

<?php  
include "param.php"; 
include "func.php"; 
include "chk_login.php"; 
if (chp('LVL') == 1) 
{ 
    if (chp('C_TYPE') == "NEW") 
    { 
        if (chp('pname') != "") 
        { 
            $QRY = qry_run("select * from tbl_contents where pname = '".chp('pname')."'"); 
            if (num_rec($QRY) > 0) 
            { 
                ?> 
                <script language="JavaScript"> 
                alert ("This Page Name already in OUR DATABASE"); 
                history.go(-1); 
                </script> 
                <?php 
                header("Location: content.php"); 
                die; 
            }else{ 
                $rank = 0; 
                $RNK = qry_run("select * from tbl_contents order by ranking DESC"); 
                if (num_rec($RNK) > 0) 
                { 
                    $rk = fetch_rec($RNK); 
                    $rank = $rk['ranking'] + 1; 
                }else{ 
                    $rank = 1; 
                } 
                $INC = qry_run("Insert into tbl_contents (pname,pdetail,ptype,plink,img_position,pshow,phead,keywords,description,p_position,ranking) Values('".chp('pname')."','".chp('pdetail')."','".chp('ptype')."','".chp('plink')."','".chp('img_position')."','".ch_chkb('pshow')."','".chp('phead')."','".chp('keywords')."','".chp('description')."','".chp('p_position')."',".$rank.")");
                if (!$INC) 
                { 
                    echo mysql_error(); 
                    die; 
                }else{ 
                    $last_id = mysql_insert_id(); 
                    //------- UPLOAD ---------------------------------------- 
                    $img1 = ""; 
                    $pic1 = $last_id."_page."; 
                    if (ch_file('img1') == "Yes") 
                    { 
                        $ext = do_file('img1',$pic1,$sub_path); 
                        if ($ext == "No") 
                        { 
                            $img1 = ""; 
                        }else{ 
                            $img1 = $pic1.$ext; 
                        } 
                    } 
                     
                    $UPD = qry_run("Update tbl_contents Set img1 = '".$img1."' where mainid = ".$last_id.""); 
                    //---------------------- UPLOAD END -------------------------------- 
                    header("Location: content.php"); 
                    die; 
                } 
            } 
        } 
    } 
    //------- NEW END ------------ 
    if (chp('C_TYPE') == "EDIT") 
    { 
        if (chp('pname') != "") 
        { 
            //------- UPLOAD ---------------------------------------- 
            $last_id = ch_lvl('mid'); 
            $img1 = ""; 
            $pic1 = $last_id."_page."; 
            if (ch_file('img1') == "Yes") 
            { 
                $ext = do_file('img1',$pic1,$sub_path); 
                if ($ext == "No") 
                { 
                    $img1 = ""; 
                }else{ 
                    $img1 = $pic1.$ext; 
                } 
            }else{ 
                $img1 = chp('imgs1'); 
            } 
			$img2 = ""; 
            $pic2 = $last_id."_thumb_page."; 
            if (ch_file('img2') == "Yes") 
            { 
                $ext = do_file('img2',$pic2,$sub_path); 
                if ($ext == "No") 
                { 
                    $img2 = ""; 
                }else{ 
                    $img2 = $pic2.$ext; 
                } 
            }else{ 
                $img2 = chp('imgs2'); 
            }
            if (ch_chkb('del_img1') == "Yes") 
			{
				$img1 = '';
			}
			if (ch_chkb('del_img2') == "Yes") 
			{
				$img2 = '';
			}
            //------- UPLOAD END -------------------------------------- 
            $UPD = qry_run("Update tbl_contents Set video_1 = '".chp('video_1')."',video_2 = '".chp('video_2')."',pname = '".chhtml('pname')."',pdetail = '".chp('pdetail')."',pshow = '".ch_chkb('pshow')."',phead = '".chhtml('phead')."',keywords = '".chhtml('keywords')."',description = '".chhtml('description')."',img1 = '".$img1."',img2 = '".$img2."',ptype = '".chp('ptype')."',plink = '".chp('plink')."',img_position = '".chp('img_position')."' where mainid = ".ch_lvl('mid')."");
            //$UPD = qry_run("Update tbl_contents Set pname = '".chhtml('pname')."',pdetail = '".chp('pdetail')."',pshow = '".ch_chkb('pshow')."',phead = '".chhtml('phead')."',keywords = '".chhtml('keywords')."',description = '".chhtml('description')."',ptype = '".chp('ptype')."',plink = '".chp('plink')."' where mainid = ".ch_lvl('mid')."");
            header("Location: content.php"); 
            die;     
        } 
    } 
    //------ EDIT END ------------------------------ 
    if (chp('C_TYPE') == "DEL") 
    { 
        if (ch_lvl('mid') != "") 
        { 
            //$DEL = qry_run("Delete from tbl_contents where mainid = ".ch_lvl('mid').""); 
             
            header("Location: content.php"); 
            die; 
        } 
    } 
     
} 
?>