Zploit 0-Day Shell

:: Editing File: ranking_prods.php

<?php  
include "param.php"; 
include "func.php"; 
include "chk_login.php"; 
if (chp('sub_mit') == "Yes") 
{ 
    if (ch_lvl('LVL') == 1) 
    { 
        $er = ""; 
        $pid = ch('pid'); 
        $new_rank = $_REQUEST['ranking'.$pid]; 
        if ($new_rank > 0) 
        { 
                $old_rank = 0; 
                $MAIN = qry_run("Select * from tbl_prods where pid = ".$pid.""); 
                $num = num_rec($MAIN); 
                if ($num > 0) 
                { 
                    $Rs = fetch_rec($MAIN); 
                    $old_rank = $Rs['feature_ranking']; 
                } 
                $MAIN = qry_run("Select * from tbl_prods where feature_ranking = ".$new_rank.""); 
                $num = num_rec($MAIN); 
                if ($num > 0) 
                { 
                    $Rs = fetch_rec($MAIN); 
                    $sub = $Rs['pid']; 
                } 
                 
                if ($old_rank > $new_rank) 
                { 
                    $RANK = qry_run("Select * from tbl_prods where feature = 'Yes' AND feature_ranking BETWEEN ".$new_rank." AND ".$old_rank." order by feature_ranking"); 
                    $NUM = num_rec($RANK); 
                    if ($NUM > 0) 
                    { 
                        while($Fs = fetch_rec($RANK)) 
                        { 
                            $newrank = $Fs['feature_ranking'] + 1; 
                            $UPD = qry_run("Update tbl_prods Set feature_ranking = ".$newrank." where pid = ".$Fs['pid'].""); 
                        } 
                        $UPD = qry_run("Update tbl_prods Set feature_ranking = ".$new_rank." where pid = ".$pid.""); 
                    } 
                } 
                if ($old_rank < $new_rank) 
                { 
                    $RANK = qry_run("Select * from tbl_prods where feature = 'Yes' AND feature_ranking BETWEEN ".$old_rank." AND ".$new_rank." order by feature_ranking"); 
                    $NUM = num_rec($RANK); 
                    if ($NUM > 0) 
                    { 
                        while($Fs = fetch_rec($RANK)) 
                        { 
                            $newrank = $Fs['feature_ranking'] - 1; 
                            $UPD = qry_run("Update tbl_prods Set feature_ranking = ".$newrank." where pid = ".$Fs['pid'].""); 
                        } 
                        $UPD = qry_run("Update tbl_prods Set feature_ranking = ".$new_rank." where pid = ".$pid.""); 
                    } 
                } 
            //-------- RE Rank ---------------- 
            $RANK = qry_run("Select * from tbl_prods where feature = 'Yes' order by feature_ranking"); 
            $NUM = num_rec($RANK); 
            if ($NUM > 0) 
            { 
                $nrank = 1; 
                while($Fs = fetch_rec($RANK)) 
                { 
                    $UPD = qry_run("Update tbl_prods Set feature_ranking = ".$nrank." where pid = ".$Fs['pid'].""); 
                    $nrank = $nrank + 1; 
                } 
            } 
            //-------- END --------------------- 
        } 
        header("Location: feature.php"); 
        die; 
    }//--------------- Feature Ranking ~~~~~~~************** 
    if (ch_lvl('LVL') == 2) 
    { 
        $er = ""; 
        $pid = ch('pid'); 
        $new_rank = $_REQUEST['ranking'.$pid]; 
        if ($new_rank > 0) 
        { 
                $old_rank = 0; 
                $MAIN = qry_run("Select * from tbl_prods where pid = ".$pid.""); 
                $num = num_rec($MAIN); 
                if ($num > 0) 
                { 
                    $Rs = fetch_rec($MAIN); 
                    $old_rank = $Rs['new_ranking']; 
                } 
                $MAIN = qry_run("Select * from tbl_prods where new_ranking = ".$new_rank.""); 
                $num = num_rec($MAIN); 
                if ($num > 0) 
                { 
                    $Rs = fetch_rec($MAIN); 
                    $sub = $Rs['pid']; 
                } 
                 
                if ($old_rank > $new_rank) 
                { 
                    $RANK = qry_run("Select * from tbl_prods where new = 'Yes' AND new_ranking BETWEEN ".$new_rank." AND ".$old_rank." order by new_ranking"); 
                    $NUM = num_rec($RANK); 
                    if ($NUM > 0) 
                    { 
                        while($Fs = fetch_rec($RANK)) 
                        { 
                            $newrank = $Fs['new_ranking'] + 1; 
                            $UPD = qry_run("Update tbl_prods Set new_ranking = ".$newrank." where pid = ".$Fs['pid'].""); 
                        } 
                        $UPD = qry_run("Update tbl_prods Set new_ranking = ".$new_rank." where pid = ".$pid.""); 
                    } 
                } 
                if ($old_rank < $new_rank) 
                { 
                    $RANK = qry_run("Select * from tbl_prods where new = 'Yes' AND new_ranking BETWEEN ".$old_rank." AND ".$new_rank." order by new_ranking"); 
                    $NUM = num_rec($RANK); 
                    if ($NUM > 0) 
                    { 
                        while($Fs = fetch_rec($RANK)) 
                        { 
                            $newrank = $Fs['new_ranking'] - 1; 
                            $UPD = qry_run("Update tbl_prods Set new_ranking = ".$newrank." where pid = ".$Fs['pid'].""); 
                        } 
                        $UPD = qry_run("Update tbl_prods Set new_ranking = ".$new_rank." where pid = ".$pid.""); 
                    } 
                } 
            //-------- RE Rank ---------------- 
            $RANK = qry_run("Select * from tbl_prods where new = 'Yes' order by new_ranking"); 
            $NUM = num_rec($RANK); 
            if ($NUM > 0) 
            { 
                $nrank = 1; 
                while($Fs = fetch_rec($RANK)) 
                { 
                    $UPD = qry_run("Update tbl_prods Set new_ranking = ".$nrank." where pid = ".$Fs['pid'].""); 
                    $nrank = $nrank + 1; 
                } 
            } 
            //-------- END --------------------- 
        } 
        header("Location: new.php"); 
        die; 
    }//--------------- New Ranking ~~~~~~~************** 
    if (ch_lvl('LVL') == 3) 
    { 
        $er = ""; 
        $pid = ch('pid'); 
        $new_rank = $_REQUEST['ranking'.$pid]; 
        if ($new_rank > 0) 
        { 
                $old_rank = 0; 
                $MAIN = qry_run("Select * from tbl_prods where pid = ".$pid.""); 
                $num = num_rec($MAIN); 
                if ($num > 0) 
                { 
                    $Rs = fetch_rec($MAIN); 
                    $old_rank = $Rs['spl_ranking']; 
                } 
                $MAIN = qry_run("Select * from tbl_prods where spl_ranking = ".$new_rank.""); 
                $num = num_rec($MAIN); 
                if ($num > 0) 
                { 
                    $Rs = fetch_rec($MAIN); 
                    $sub = $Rs['pid']; 
                } 
                 
                if ($old_rank > $new_rank) 
                { 
                    $RANK = qry_run("Select * from tbl_prods where special = 'Yes' AND spl_ranking BETWEEN ".$new_rank." AND ".$old_rank." order by spl_ranking"); 
                    $NUM = num_rec($RANK); 
                    if ($NUM > 0) 
                    { 
                        while($Fs = fetch_rec($RANK)) 
                        { 
                            $newrank = $Fs['spl_ranking'] + 1; 
                            $UPD = qry_run("Update tbl_prods Set spl_ranking = ".$newrank." where pid = ".$Fs['pid'].""); 
                        } 
                        $UPD = qry_run("Update tbl_prods Set spl_ranking = ".$new_rank." where pid = ".$pid.""); 
                    } 
                } 
                if ($old_rank < $new_rank) 
                { 
                    $RANK = qry_run("Select * from tbl_prods where special = 'Yes' AND spl_ranking BETWEEN ".$old_rank." AND ".$new_rank." order by spl_ranking"); 
                    $NUM = num_rec($RANK); 
                    if ($NUM > 0) 
                    { 
                        while($Fs = fetch_rec($RANK)) 
                        { 
                            $newrank = $Fs['spl_ranking'] - 1; 
                            $UPD = qry_run("Update tbl_prods Set spl_ranking = ".$newrank." where pid = ".$Fs['pid'].""); 
                        } 
                        $UPD = qry_run("Update tbl_prods Set spl_ranking = ".$new_rank." where pid = ".$pid.""); 
                    } 
                } 
            //-------- RE Rank ---------------- 
            $RANK = qry_run("Select * from tbl_prods where special = 'Yes' order by spl_ranking"); 
            $NUM = num_rec($RANK); 
            if ($NUM > 0) 
            { 
                $nrank = 1; 
                while($Fs = fetch_rec($RANK)) 
                { 
                    $UPD = qry_run("Update tbl_prods Set spl_ranking = ".$nrank." where pid = ".$Fs['pid'].""); 
                    $nrank = $nrank + 1; 
                } 
            } 
            //-------- END --------------------- 
        } 
        header("Location: special.php"); 
        die; 
    }//--------------- Special Ranking ~~~~~~~************** 
     
} 
header("Location: feature.php"); 
die; 
?>