shell bypass 403

GrazzMean Shell

: /var/www/vhosts/m-auto.co/httpdocs/admin/ [ drwxr-xr-x ]
Uname: Linux serv.m-auto.co 3.10.0-1160.42.2.el7.x86_64 #1 SMP Tue Sep 7 14:49:57 UTC 2021 x86_64
Software: nginx/1.28.2
PHP version: 8.1.34 [ PHP INFO ] PHP os: Linux
Server Ip: 41.215.243.19
Your Ip: 216.73.216.151
User: m-auto.co_vxasg6smqe (10000) | Group: psacln (1003)
Safe Mode: OFF
Disable Function:
opcache_get_status,mail

name : video_process.php
<?php
include 'auth.php';

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    if (empty($_POST['id'])) {
        require_permission('videos_add');
    } else {
        require_permission('videos_edit');
    }
    $id = $_POST['id'];
    $title = $_POST['title'];
    $description = $_POST['description'];
    $video_type = $_POST['video_type'];
    $video_url = $_POST['video_url'] ?? '';
    $active = isset($_POST['active']) ? 1 : 0;
    $current_video_file = $_POST['current_video_file'] ?? '';
    $current_thumbnail = $_POST['current_thumbnail'] ?? '';
    $video_file_name = $current_video_file;
    $thumbnail_name = $current_thumbnail;

    // Video File Upload
    if (isset($_FILES['video_file']) && $_FILES['video_file']['error'] == 0) {
        $upload_dir = '../uploads/videos/';
        $video_file_name = uniqid() . '-' . basename($_FILES['video_file']['name']);
        $target_file = $upload_dir . $video_file_name;
        
        if (move_uploaded_file($_FILES['video_file']['tmp_name'], $target_file)) {
            if (!empty($current_video_file) && file_exists($upload_dir . $current_video_file)) {
                unlink($upload_dir . $current_video_file);
            }
        } else {
            header("Location: videos.php?error=فشل في رفع ملف الفيديو");
            exit();
        }
    }

    // Thumbnail Upload
    if (isset($_FILES['thumbnail']) && $_FILES['thumbnail']['error'] == 0) {
        $upload_dir = '../uploads/videos/';
        $thumbnail_name = uniqid() . '-thumb-' . basename($_FILES['thumbnail']['name']);
        $target_file = $upload_dir . $thumbnail_name;
        
        if (move_uploaded_file($_FILES['thumbnail']['tmp_name'], $target_file)) {
            if (!empty($current_thumbnail) && file_exists($upload_dir . $current_thumbnail)) {
                unlink($upload_dir . $current_thumbnail);
            }
        } else {
            header("Location: videos.php?error=فشل في رفع الصورة المصغرة");
            exit();
        }
    }

    // Clear video_url if type is file, clear video_file if type is url
    if ($video_type == 'file') {
        $video_url = '';
    } else {
        $video_file_name = '';
        $thumbnail_name = '';
    }

    if (empty($id)) {
        // INSERT
        $sql = "INSERT INTO videos (title, description, video_url, video_file, thumbnail, video_type, active) VALUES (?, ?, ?, ?, ?, ?, ?)";
        $stmt = $conn->prepare($sql);
        $stmt->bind_param("ssssssi", $title, $description, $video_url, $video_file_name, $thumbnail_name, $video_type, $active);
    } else {
        // UPDATE
        $sql = "UPDATE videos SET title=?, description=?, video_url=?, video_file=?, thumbnail=?, video_type=?, active=? WHERE id=?";
        $stmt = $conn->prepare($sql);
        $stmt->bind_param("ssssssii", $title, $description, $video_url, $video_file_name, $thumbnail_name, $video_type, $active, $id);
    }

    if ($stmt->execute()) {
        header("Location: videos.php?success=تم حفظ الفيديو بنجاح");
    } else {
        header("Location: videos.php?error=حدث خطأ: " . $stmt->error);
    }

    $stmt->close();
    $conn->close();

} else {
    header("Location: videos.php");
    exit();
}
?>
© 2026 GrazzMean