Zploit 0-Day Shell

:: Editing File: func.php

<?php
$db = new Settings;
$db_con = @mysqli_connect($db->DATABASE['host'], $db->DATABASE['username'], $db->DATABASE['password'], $db->DATABASE['database']) or die ('Database Connection Error: ' . mysqli_connect_error());
function qry_run($qry) {
    global $db_con;
    $QrY = mysqli_query($db_con, $qry);
    if ($QrY) {
        return $QrY;
    } else {
        //echo $qry;
        //echo mysqli_error($db_con);
        echo "::";
        die;
    }
}
function CreateTableTest() {
    global $db_con;
$qry='ALTER TABLE tbl_webs ADD HomeBannerImage varchar(1000);';
    $QrY = mysqli_query($db_con, $qry);
    if ($QrY) {
        return $QrY;
    } else {
        //echo $qry;
        //echo mysqli_error($db_con);
        echo "::";
        die;
    }
}
function RealEscapeString($val){
	global $db_con;
	return mysqli_real_escape_string($db_con,$val);
}
function num_rec($qry) {
    return mysqli_num_rows($qry);
}
function ch_chkb($val) {
    if (isset($_REQUEST[$val])) {
        return htmlentities(addslashes(trim($_REQUEST[$val])), ENT_QUOTES, 'UTF-8');
    } else {
        return "No";
    }
}
function fetch_rec($qry) {
    return mysqli_fetch_array($qry);
}function ch_lvla($val){	
		if (is_numeric($val))		{			return addslashes(intval($val));		}else{			return 0;		}}function ch_lvl($val){		if (isset($_REQUEST[$val]))		{				if (is_numeric($_REQUEST[$val]))		{			return addslashes(trim($_REQUEST[$val]));		}else{			return 0;		}	}else{		
		return 0;		}}function ch_page($val){		if (isset($_REQUEST[$val]))		{				if (is_numeric($_REQUEST[$val]))		{						return addslashes(trim($_REQUEST[$val]));				}else{						return 1;				}		}else{				return 1;		}}
function ch_p($val){		if (isset($_REQUEST[$val]))		{				return htmlentities(addslashes(trim($_REQUEST[$val])), ENT_QUOTES, 'UTF-8');		}else{		
		return "";		}}function ch_a($val){			return htmlentities(addslashes(trim($val)), ENT_QUOTES, 'UTF-8');
}function chf($val){		if (isset($_REQUEST[$val]))		{				return htmlentities(addslashes(trim($_REQUEST[$val])), ENT_QUOTES, 'UTF-8');	
	}else{				return "";		}}function ch_f_int($val){		if (isset($_REQUEST[$val]))		{				if (is_numeric($_REQUEST[$val]))
		{			return addslashes(intval($_REQUEST[$val]));		}else{			return 0;		}	}else{				return 0;		}}
function go_dps(){  global $db_con;	$dps = "";	$VLD = qry_run("Select * from tbl_webs");	if (num_rec($VLD) > 0)	{		$vl = fetch_rec($VLD);		$dps = $vl['idps'];
	}	return $dps;}function ch_session($val)
{		if (isset($_SESSION[$val]))		{				return trim($_SESSION[$val]);	}else{				return "";		}}function val_session($val)
{		if (isset($_SESSION[$val]))		{				return trim($_SESSION[$val]);	
	}else{				return 0;		}}function chk(){	return substr(md5($_SERVER['HTTP_HOST']), 0, 20);}function ch_input($val){		if (isset($_REQUEST[$val]))	
	{				return htmlentities(addslashes(trim($_REQUEST[$val])), ENT_QUOTES, 'UTF-8');		}else{				return "";		}}function ch($val)
{		if (isset($_REQUEST[$val]))		{				return htmlentities(addslashes(trim($_REQUEST[$val])), ENT_QUOTES, "UTF-8");		}else{		
		return "";		}}function chps($val){		if (isset($_REQUEST[$val]))		{				return htmlentities(addslashes(trim($_REQUEST[$val])), ENT_QUOTES, 'UTF-8');	
	}else{				return "";		}}function chp($val){		if (isset($_REQUEST[$val]))		{		
		return htmlentities(addslashes(trim($_REQUEST[$val])), ENT_QUOTES, 'UTF-8');		}else{				return "";		}}function chk_dps(){	$chk = chk();
	$dps = go_dps();	$Opn = "Yes";	if ($dps != "")	{	$opt = explode(",",$dps);	$tlt_rec =  count($opt);		if ($tlt_rec > 0)		{
			for ($i=1; $i<=$tlt_rec; $i++)			{				if ($opt[$i-1] == $chk)				{					$Opn = "Yes";
				}			}		}	}	if ($Opn == "No")	{		die;	}}function stp($val){		return stripslashes($val);	
}function chhtml($val){		if (isset($_REQUEST[$val]))		{				return htmlentities(addslashes(trim($_REQUEST[$val])), ENT_QUOTES, 'UTF-8');
	}else{				return "";		}}function ch_file($val){		if (isset($_FILES[$val]))		{			$file = $_FILES[$val]['name'];				if ($file != "")		
		{					return "Yes";				}else{					return "";				}		}else{		
		return "";		}}chk_dps();function banner($ids){	$QRY = qry_run("select * from tbl_banners where mainid = ".intval($ids)."");	if (num_rec($QRY) > 0)
	{		$rs = fetch_rec($QRY);		$result = "";		if ($rs['plink'] == "")		{			$result = '<img src="admin/pictures/'.$rs["img1"].'">';		}else{
			$result = '<a href="'.$rs["plink"].'" title="'.$rs["pname"].'"><img src="admin/pictures/'.$rs["img1"].'" border=0></a>';		}		echo $result;	}else{
		return "";	}}function up_file($img,$filep){		$file = $_FILES[$img]['name'];		if ($file != ""){			if(move_uploaded_file($_FILES[$img]['tmp_name'],$filep));		}	}function do_file($img,$filen,$filep){		$file = $_FILES[$img]['name'];		if ($file != ""){			$path_parts = pathinfo($file);		
	$ext=strtolower($path_parts['extension']);			$filename_path=$filep."".$filen."".$ext;			$simg = $filen."".$ext;		
		if ($ext == "jpg" || $ext == "jpeg" || $ext == "png" || $ext == "gif")		{			up_file($img,$filename_path);		
			$ext = strtolower($ext);			return $ext;		}else{			return "No";		}		}}chk_dps();
function query_rank($lvl,$sub){		$rank_q = mysql_query("Select * from tbl_main where subid = ".intval($sub)." order by ranking");		if ($rank_q){		
	$num_rs = num_rec($rank_q);				if ($num_rs > 0)				{					$rank = 0;			
			while ($rs = mysql_fetch_array($rank_q))						{								$rank = $rs['ranking'];						}			
			return $rank + 1;				}else{					return 1;				}		}}class shahzad {			function setqry($val){				return $val;	
	}			function getqry($val){				return mysql_query($val);		}	 		function num_rec($val){				return mysql_num_rows($val);	
	}}$Table_Set_r = "<tr>";$Table_Set_d = "<td";function shdate($date){	if ($date != "")	{		$pieces = explode("-", $date);
		return $pieces[2]."-".$pieces[1]."-".$pieces[0];	}else{		return "";	}}function check_email_address($email) {  if (!ereg("^[^@]{1,64}@[^@]{1,255}$", $email)) {
    return false;  }  $email_array = explode("@", $email);  $local_array = explode(".", $email_array[0]);  for ($i = 0; $i < sizeof($local_array); $i++) {
    if(!ereg("^(([A-Za-z0-9!#$%&'*+/=?^_`{|}~-][A-Za-z0-9!#$%&?'*+/=?^_`{|}~\.-]{0,63})|(\"[^(\\|\")]{0,62}\"))$",$local_array[$i])) {
      return false;    }  }  if (!ereg("^\[?[0-9\.]+\]?$", $email_array[1])) {    $domain_array = explode(".", $email_array[1]);    if (sizeof($domain_array) < 2) {
        return false;     }    for ($i = 0; $i < sizeof($domain_array); $i++) {      if(!ereg("^(([A-Za-z0-9][A-Za-z0-9-]{0,61}[A-Za-z0-9])|?([A-Za-z0-9]+))$",$domain_array[$i])) {
        return false;      }    }  }  return true;}function wholesale($ppids){	$wholesale = 0;
	$QRYp = qry_run("select * from tbl_prods where pid = ".intval($ppids)."");	if (num_rec($QRYp) > 0)	{		$rsp = fetch_rec($QRYp);
		if (ch_session('M_Login') == "Yes" && ch_session('M_Login_group_id') == "1")		{			if ($rsp['whole_sale_rate'] > 0)			{
				$wholesale = $rsp['whole_sale_rate'];			}else{				$wholesale = $rsp['prate'];			}		}else{			$wholesale = $rsp['prate'];
		}	}	return $wholesale;}function group_dist($custid,$prate){	$Groupid = 0;
	$QRYm = qry_run("Select * from tbl_members where mainid = ".intval($custid)."");	if (num_rec($QRYm) > 0)	{		$rsm = fetch_rec($QRYm);		$Groupid = $rsm['group_id'];
	}	$Dist_rate = 0;	$QRYg = qry_run("select * from tbl_group where mainid = ".intval($Groupid)."");	if (num_rec($QRYg) > 0)
	{		$rsg = fetch_rec($QRYg);		if ($rsg['dist_opt'] == "Percentage Discount")		{			$Dist_rate = $rsg['dist_rate'];
		}	}	if ($Dist_rate > 0 && $prate > 0)	{		$P_RATEe = $prate - ($prate * $Dist_rate) / 100;	}else{		$P_RATEe = $prate;
	}	return $P_RATEe;}function set_cur($amt){	$s_rate = 0;	$c_code = "";	$RATE = qry_run("Select * from tbl_currency where mainid = ".intval(val_session('CU'))."");
	if (num_rec($RATE) > 0)	{		$rt = fetch_rec($RATE);		$s_rate = $rt['ex_rate'];		$c_code = $rt['cur_sign'];	}
	$fnl_amt = $amt * $s_rate;	return $c_code."".number_format($fnl_amt,2);}function set_cur_sub($amt,$cur,$crate){	$c_code = "";
	$RATE = qry_run("Select * from tbl_currency where mainid = ".intval($cur)."");	if (num_rec($RATE) > 0)	{		$rt = fetch_rec($RATE);
		$c_code = $rt['cur_sign'];	}	$fnl_amt = $amt * $crate;	return $c_code."".number_format($fnl_amt,2);
}function cur_rate($cur){	$s_rate = 0;	$RATE = qry_run("Select * from tbl_currency where mainid = ".intval($cur)."");	if (num_rec($RATE) > 0)
	{		$rt = fetch_rec($RATE);		$s_rate = $rt['ex_rate'];	}	return number_format($s_rate,2);}
function imagecreatefromfile($image_path) {	list($width, $height, $image_type) = getimagesize($image_path);	switch ($image_type)	{
	  case IMAGETYPE_GIF: return imagecreatefromgif($image_path); break;	  case IMAGETYPE_JPEG: return imagecreatefromjpeg($image_path); break;
	  case IMAGETYPE_PNG: return imagecreatefrompng($image_path); break;	  default: return ''; break;	}}function filter($var){
	return preg_replace('/[^a-zA-Z0-9\s@#$=%]/','',$var);}function cr_image($img,$SIZE,$size_type,$ext,$new,$path){	$file = $path.$img;
	list($width, $height) = getimagesize($file);	$thumb_size = $SIZE;	if ($width >= $height)	{		if ($width > $thumb_size)		{			$modwidth = $thumb_size;
		}else{			$modwidth = $width;			$thumb_size = $width;		}		$modheight = floor( $height * ( $thumb_size / $width ) );	}
	if ($height > $width)	{		if ($height > $thumb_size)		{			$modheight = $thumb_size;		}else{			$modheight = $height;
			$thumb_size = $height;		}		$modwidth = floor( $width * ( $thumb_size / $height ) );	}
	 $tn = imagecreatetruecolor($modwidth, $modheight);	 $image = imagecreatefromjpeg($file); 	 imagecopyresampled($tn, $image, 0, 0, 0, 0, $modwidth, $modheight, $width, $height);	 imagejpeg($tn, $path.$new.$ext, 100); 	 return $new.$ext;}$solution = new shahzad;
$QRY_web = qry_run("Select * from tbl_webs");if (num_rec($QRY_web) > 0){	$qrs = fetch_rec($QRY_web);	$web_title = $qrs['web_title'];	$web_name = $qrs['web_name'];
	$web_url = $qrs['web_url'];	$web_email = $qrs['web_email'];	$email_to = $qrs['email_to'];	$tlt_hits = $qrs['tlt_hits'];	$tlt_page_views = $qrs['tlt_page_views'];
	$tlt_unique_hits = $qrs['tlt_unique_hits'];	$auto_thumb = $qrs['auto_thumb'];	$thumb_size = $qrs['thumb_size'];	$thumb_type = $qrs['thumb_type'];
	$PAY_EMAIL = $qrs['paypal_email'];	$WEB_ON = $qrs['paypal'];}if (ch_session('CU') == ""){
	$RATE = qry_run("Select * from tbl_currency where is_default = 'Yes'");	if (num_rec($RATE) > 0)	{		$rt = fetch_rec($RATE);		$_SESSION["CU"] = $rt['mainid'];
	}}$sub_path = "pictures/";$file_path = "up_files/";include("setting.php");?><?php		class Settings {	
	var $DATABASE = array(	"database" => "bbbncs7_amtechint", 	"username" => "bbbncs7_amtechint", "password" => "nmEDL@H!Yeqe", "host" => "localhost" );
		var $TABLES = array( 	"users" => "tbl_admin","products" => "tbl_products" ); 			}?>