Zploit 0-Day Shell

:: Editing File: subscriber.php

<?php  
include "param.php"; 
include "func.php"; 
include "chk_login.php"; 
?> 
<html> 
<head> 
<title><?=$web_title?></title> 
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> 
<link href="style.css" rel="stylesheet" type="text/css"> 
<script type="text/javascript" src="chk_frm.js"></script> 
<script language="JavaScript"> 
function chk_form() 
{ 
if (test(document.frm_add.email,":.. Please enter Subscriber E-mail Address.:")==false) return false; 
return true; 
} 
function send_letter(mid) 
{ 
    var url; 
    url = 'send_letter.php?mid='+mid 
    microsite_window=window.open(url,'microsite_window','toolbar=no,location=no,borders=no,directories=no,status=yes,menubar=no,scrollbars=no,top=150,left=100,resizable=no,width=200,height=200') 
    microsite_window.focus(); 
} 
</script> 
</head> 
<body leftmargin="0" topmargin="0" marginwidth="0" marginheight="0"> 
<table width="100%" height="100%" border="0" cellpadding="0" cellspacing="0"> 
  <tr>  
    <td height="21" align="center" valign="top"><?php include("top_cp.php"); ?></td> 
  </tr> 
  <tr>  
    <td align="center" valign="top"><table width="990" height="100%" border="0" cellpadding="0" cellspacing="0" class="base"> 
        <tr>  
          <td height="2" colspan="2"><img src="imgs/cp/spacer.gif" width="8" height="8"></td> 
        </tr> 
        <tr>  
          <td width="190" valign="top"><?php include("left_cp.php"); ?></td> 
          <td width="800" valign="top"><table width="800" border="0" cellspacing="0" cellpadding="0"> 
              <tr>  
                <td width="546" height="29" background="imgs/cp/menu_cat_bg.jpg" class="left_menu_head" style="padding:4px;"><a href="home.php" class="left_menu_head">Home</a>  
                  | Subscriber's List</td> 
                <td width="254" align="right" background="imgs/cp/menu_cat_bg.jpg" class="left_menu_head" style="padding:4px;"><a href="sub_group.php" class="btn">Manage  
                  Subscriber's Groups </a>&nbsp;<a href="#" class="btn" onClick="javascript:showp('new');hidep('CAT');">Add  
                  New </a></td> 
              </tr> 
              <tr> 
                <td colspan="2"><div id="new" style="display:none"> 
                    <table width="800" border="0" cellpadding="4" cellspacing="0" class="base"> 
                      <form action="subscriber_process.php" method="post" enctype="multipart/form-data" name="frm_add" onSubmit="javascript:return chk_form();"> 
                        <input type="hidden" name="sub_mit" value="Y"> 
                        <input type="hidden" name="LVL" value="1"> 
                        <input type="hidden" name="C_TYPE" value="NEW"> 
                        <tr align="left">  
                          <td height="29" colspan="4" background="imgs/cp/menu_bg.jpg"><strong>Add&nbsp;  
                            New Subscriber</strong></td> 
                        </tr> 
                        <tr>  
                          <td width="102" height="25" align="right">Subscriber  
                            Name :</td> 
                          <td width="387"><input name="pname" type="text" class="txt_id" id="pname" size="50" maxlength="100"></td> 
                          <td width="53" align="right">Active:</td> 
                          <td width="226"><input name="pshow" type="checkbox" id="pshow" value="Yes" checked></td> 
                        </tr> 
                        <tr>  
                          <td height="25" align="right">Email:</td> 
                          <td colspan="3"><input name="email" type="text" class="txt_id" id="email" size="50" maxlength="100"></td> 
                        </tr> 
                        <tr> 
                          <td height="25" align="right">Group&nbsp;Name:</td> 
                          <td colspan="3"><select name="group" class="txt_id" id="group"> 
                              <option value="0^0">- Select a Group -</option> 
                            <?php 
                            $QRY = qry_run("select * from tbl_mail_group order by mainid"); 
                            if (num_rec($QRY) > 0) 
                            { 
                                while($rs = fetch_rec($QRY)) 
                                { 
                            ?> 
                              <option value="<?=$rs['mainid']?>^<?=$rs['pname']?>"><?=$rs['pname']?></option> 
                            <?php 
                                } 
                            } 
                            ?> 
                            </select></td> 
                        </tr> 
                        <tr>  
                          <td height="25" align="right">&nbsp;</td> 
                          <td colspan="3"><input name="Submit" type="submit" class="btn" value="Submit">  
                            <input name="Submit2" type="button" class="btn" value="Cancel" onClick="hidep('new');showp('CAT');"></td> 
                        </tr> 
                      </form> 
                    </table> 
                  </div></td> 
              </tr> 
              <tr>  
                <td colspan="2"><div id="CAT" style="display:block;"> 
                    <table width="800" border="0" cellpadding="4" cellspacing="0" class="base"> 
                      <tr>  
                        <td width="34" height="29" background="imgs/cp/menu_bg.jpg"><strong>#</strong></td> 
                        <td width="201" background="imgs/cp/menu_bg.jpg"><strong>Subscriber  
                          Name </strong></td> 
                        <td width="175" background="imgs/cp/menu_bg.jpg"><strong>E-mail</strong></td> 
                        <td width="191" background="imgs/cp/menu_bg.jpg"><strong>Group</strong></td> 
                        <td width="71" background="imgs/cp/menu_bg.jpg"><strong>Active</strong></td> 
                        <td width="80" background="imgs/cp/menu_bg.jpg">&nbsp;</td> 
                      </tr> 
                      <?php 
                    if (isset($_SERVER['QUERY_STRING'])) 
                    { 
                        $_SESSION["RTN_STRs"] = $_SERVER['PHP_SELF']."?".$_SERVER['QUERY_STRING']; 
                    }else{ 
                        $_SESSION["RTN_STRs"] = $_SERVER['PHP_SELF']; 
                    } 
                    $cur_page = ch_page('cur'); 
                    $PER_PAGE = 50; 
                    $prod_page = $PER_PAGE; 
                    $perpage = $prod_page; 
                    if ($cur_page == 1) 
                    { 
                    $subt = 0; 
                    }else{ 
                    $subt = $cur_page * $prod_page; 
                    $subt = $subt - $prod_page; 
                    } 
                    $SQL = "select * from tbl_subscribers order by mainid"; 
                    $queryn = qry_run($SQL); 
                    $rs_n = num_rec($queryn); 
                    $SQL = $SQL . " limit $subt,$perpage"; 
                    $QRY = qry_run($SQL); 
                    if (num_rec($QRY) > 0) 
                    { 
                        $p = 1; 
                        while($rs = fetch_rec($QRY)) 
                        { 
                             
                    ?> 
                      <tr bgcolor="#FFFFFF" onMouseOver="this.bgColor = '#F8FCFF'" onMouseOut ="this.bgColor = '#FFFFFF'">  
                        <td height="29" style="border-style:solid;border-width:0px 0px 1px 0px;border-color:#DFEDF8;">  
                          <?=$p?> 
                          .</td> 
                        <td height="29" style="border-style:solid;border-width:0px 0px 1px 0px;border-color:#DFEDF8;">  
                          <?=$rs['pname']?> 
                          &nbsp; </td> 
                        <td height="29" style="border-style:solid;border-width:0px 0px 1px 0px;border-color:#DFEDF8;">  
                          <?=$rs['pmail']?> 
                        </td> 
                        <td height="29" style="border-style:solid;border-width:0px 0px 1px 0px;border-color:#DFEDF8;">  
                          <?=$rs['group_name']?> 
                        </td> 
                        <td height="29" style="border-style:solid;border-width:0px 0px 1px 0px;border-color:#DFEDF8;">  
                          <?=$rs['pshow']?> 
                        </td> 
                        <td height="29" align="right" style="border-style:solid;border-width:0px 0px 1px 0px;border-color:#DFEDF8;"><table width="75" border="0" cellpadding="0" cellspacing="0" class="base_2"> 
                            <tr align="center">  
                               
                              <td width="25"><a href="edit_subscriber.php?mid=<?=$rs['mainid']?>" title="Edit  / Update"><img src="imgs/page_paintbrush.png" alt="Edit Detail" width="16" height="16" border="0"></a></td> 
                              <td width="25"><a href="subscriber_process.php?mid=<?=$rs['mainid']?>&C_TYPE=DEL&LVL=1" onclick="return confirm('Are you sure you want to delete?')"><img src="imgs/ed_delete.gif" width="18" height="18" border="0"></a></td> 
                            </tr> 
                          </table></td> 
                      </tr> 
                      <?php 
                          $p += 1;  
                        } 
                      ?> 
                      <tr bgcolor="#F1F1F1">  
                        <td height="29" colspan="6" style="border-style:solid;border-width:0px 0px 1px 0px;border-color:#DFEDF8;"> 
                        <?php 
                        $tlt = $rs_n; 
                        $next = " Next >"; 
                        $back = " < Back"; 
                        $first = " << First"; 
                        $last = " Last >>"; 
                        $tlt_rec = $tlt;  
                        $tlt_pages = ceil($tlt_rec / $perpage); 
                        $page = $cur_page; 
                        if ($page <= $tlt_pages) 
                        { 
                            if ($page <= 5) 
                            { 
                                $strt = 1; 
                            }else{ 
                                $strt = ceil($page/5); 
                                if ($page % 5) 
                                { 
                                    $strt = $strt * 5; 
                                }else{ 
                                    $strt = ($strt + 1) * 5; 
                                } 
                                $strt = ($strt - 10) + 1; 
                            } 
                            $endd = ($strt - 1) + 10; 
                            if ($endd > $tlt_pages) 
                            { 
                                $endd = $tlt_pages; 
                            } 
                            $m = $strt; 
                            if ($page > 1) 
                            { 
                                $p = $page -1; 
                                $f = 1; 
                            }else{ 
                                $p = 1; 
                                $f = 1; 
                            } 
                            if ($page > 1) 
                            { 
                                echo "<a href='subscriber.php?cur=".$f."' class = 'paging'>".$first."</a>  "; 
                                echo "<a href='subscriber.php?cur=".$p."' class = 'paging'>".$back."</a>  "; 
                            }else{ 
                                echo $first."  "; 
                                echo $back."  "; 
                            } 
                             
                            echo " | "; 
                            while ($m <= $endd) 
                            { 
                                if ($m == $page) 
                                { 
                                    echo "<a href='subscriber.php?cur=".$m."' class = 'paging_act'><strong>".$m."</strong></a> | "; 
                                }else{ 
                                    echo "<a href='subscriber.php?cur=".$m."' class = 'paging'>".$m."</a> | "; 
                                } 
                                $m = $m + 1; 
                            } 
                            if ($page < $tlt_pages) 
                            { 
                                $n = $page + 1; 
                                $l = $tlt_pages; 
                            }else{ 
                                $p = $tlt_pages; 
                                $f = $tlt_pages; 
                            } 
                            if ($endd < $tlt_pages) 
                            { 
                                echo " ..... <a href='subscriber.php?cur=".$l."' class = 'paging'><strong>".$tlt_pages."</strong></a> "; 
                            } 
                            if ($page < $tlt_pages) 
                            { 
                                echo "<a href='subscriber.php?cur=".$n."' class = 'paging'>".$next."</a>  "; 
                                echo "<a href='subscriber.php?cur=".$l."' class = 'paging'>".$last."</a>"; 
                            }else{ 
                                echo $next."  "; 
                                echo $last.""; 
                            } 
                        } 
                    ?> 
                        </td> 
                      </tr> 
                      <?php 
                    } 
                    ?> 
                    </table> 
                  </div></td> 
              </tr> 
            </table></td> 
        </tr> 
        <tr>  
          <td height="2" colspan="2"><img src="imgs/cp/spacer.gif" width="8" height="8"></td> 
        </tr> 
      </table></td> 
  </tr> 
  <tr> 
    <td height="29" align="center" background="imgs/cp/btm_bg22.jpg"><?php include("btm_cp.php"); ?></td> 
  </tr> 
</table> 
</body> 
</html>