shell bypass 403

GrazzMean Shell

: /var/www/vhosts/m-auto.co/httpdocs/admin/ [ drwxr-xr-x ]
Uname: Linux serv.m-auto.co 3.10.0-1160.42.2.el7.x86_64 #1 SMP Tue Sep 7 14:49:57 UTC 2021 x86_64
Software: nginx/1.28.2
PHP version: 8.1.34 [ PHP INFO ] PHP os: Linux
Server Ip: 41.215.243.19
Your Ip: 216.73.216.151
User: m-auto.co_vxasg6smqe (10000) | Group: psacln (1003)
Safe Mode: OFF
Disable Function:
opcache_get_status,mail

name : themes.php
<?php
include 'includes/header.php';

if (!has_permission('themes_view')) {
    echo "<div class='alert alert-danger'>ليس لديك الصلاحية لعرض هذه الصفحة.</div>";
    include 'includes/footer.php';
    exit;
}

$activeCount = 0;
$activeResult = $conn->query("SELECT COUNT(*) AS total FROM `themes` WHERE `is_active` = 1");
if ($activeResult) {
    $activeRow = $activeResult->fetch_assoc();
    if ($activeRow) {
        $activeCount = (int) $activeRow['total'];
    }
}

$defaultThemes = [
    ['name' => 'الثيم الافتراضي', 'css_file' => 'style.css'],
    ['name' => 'ثيم الكريسماس', 'css_file' => 'christmas.css'],
    ['name' => 'ثيم رمضان', 'css_file' => 'ramadan.css'],
    ['name' => 'ثيم نصر أكتوبر', 'css_file' => 'october_war.css'],
    ['name' => 'ثيم عيد الفطر', 'css_file' => 'eid_al_fitr.css'],
    ['name' => 'ثيم عيد الأضحى', 'css_file' => 'eid_al_adha.css']
];

foreach ($defaultThemes as $defaultTheme) {
    $existingStmt = $conn->prepare("SELECT `id`, `name` FROM `themes` WHERE `css_file` = ? LIMIT 1");
    $existingStmt->bind_param('s', $defaultTheme['css_file']);
    $existingStmt->execute();
    $existingResult = $existingStmt->get_result();
    $existingTheme = $existingResult ? $existingResult->fetch_assoc() : null;
    if ($existingTheme) {
        if ($existingTheme['name'] !== $defaultTheme['name']) {
            $updateStmt = $conn->prepare("UPDATE `themes` SET `name` = ? WHERE `id` = ?");
            $updateStmt->bind_param('si', $defaultTheme['name'], $existingTheme['id']);
            $updateStmt->execute();
        }
    } else {
        $isActive = $defaultTheme['css_file'] === 'style.css' && $activeCount === 0 ? 1 : 0;
        $insertStmt = $conn->prepare("INSERT INTO `themes` (`name`, `css_file`, `is_active`) VALUES (?, ?, ?)");
        $insertStmt->bind_param('ssi', $defaultTheme['name'], $defaultTheme['css_file'], $isActive);
        $insertStmt->execute();
        if ($isActive === 1) {
            $activeCount = 1;
        }
    }
}

// Handle theme activation
if (isset($_GET['activate']) && is_numeric($_GET['activate'])) {
    $theme_id = $_GET['activate'];

    // Deactivate all themes
    $conn->query("UPDATE `themes` SET `is_active` = 0");

    // Activate the selected theme
    $stmt = $conn->prepare("UPDATE `themes` SET `is_active` = 1 WHERE `id` = ?");
    $stmt->bind_param('i', $theme_id);
    $stmt->execute();

    // Update the active_theme setting
    $stmt = $conn->prepare("UPDATE `settings` SET `setting_value` = ? WHERE `setting_key` = 'active_theme'");
    $stmt->bind_param('s', $theme_id);
    $stmt->execute();

    echo "<div class='alert alert-success'>تم تفعيل الثيم بنجاح.</div>";
}

// Fetch all themes
$result = $conn->query("SELECT * FROM `themes`");
$themes = $result->fetch_all(MYSQLI_ASSOC);
?>

<div class="container-fluid">
    <h1 class="mt-4">إدارة الثيمات</h1>
    <a href="theme_form.php" class="btn btn-success mb-3">إضافة ثيم جديد</a>

    <table class="table table-bordered">
        <thead>
            <tr>
                <th>اسم الثيم</th>
                <th>ملف الـ CSS</th>
                <th>الحالة</th>
                <th>إجراءات</th>
            </tr>
        </thead>
        <tbody>
            <?php foreach ($themes as $theme): ?>
                <tr>
                    <td><?php echo htmlspecialchars($theme['name']); ?></td>
                    <td><?php echo htmlspecialchars($theme['css_file']); ?></td>
                    <td>
                        <?php if ($theme['is_active']): ?>
                            <span class="badge bg-success">نشط</span>
                        <?php else: ?>
                            <span class="badge bg-secondary">غير نشط</span>
                        <?php endif; ?>
                    </td>
                    <td>
                        <?php if (!$theme['is_active']): ?>
                            <a href="themes.php?activate=<?php echo $theme['id']; ?>" class="btn btn-primary btn-sm">تفعيل</a>
                        <?php endif; ?>
                        <a href="theme_form.php?id=<?php echo $theme['id']; ?>" class="btn btn-warning btn-sm">تعديل</a>
                        <a href="theme_delete.php?id=<?php echo $theme['id']; ?>" class="btn btn-danger btn-sm" onclick="return confirm('هل أنت متأكد من رغبتك في حذف هذا الثيم؟');">حذف</a>
                    </td>
                </tr>
            <?php endforeach; ?>
        </tbody>
    </table>
</div>

<?php include 'includes/footer.php'; ?>
© 2026 GrazzMean