shell bypass 403

GrazzMean Shell

: /var/www/vhosts/m-auto.co/httpdocs/ [ drwxr-x--- ]
Uname: Linux serv.m-auto.co 3.10.0-1160.42.2.el7.x86_64 #1 SMP Tue Sep 7 14:49:57 UTC 2021 x86_64
Software: nginx/1.28.2
PHP version: 8.1.34 [ PHP INFO ] PHP os: Linux
Server Ip: 41.215.243.19
Your Ip: 216.73.216.151
User: m-auto.co_vxasg6smqe (10000) | Group: psacln (1003)
Safe Mode: OFF
Disable Function:
opcache_get_status,mail

name : maintenance_process.php
<?php
include 'includes/db.php';
include 'includes/odoo_api.php';

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    // Sanitize and validate input
    $name = trim(filter_input(INPUT_POST, 'name', FILTER_SANITIZE_STRING));
    $phone = trim(filter_input(INPUT_POST, 'phone', FILTER_SANITIZE_STRING));
    $car_info = trim(filter_input(INPUT_POST, 'car_info', FILTER_SANITIZE_STRING));
    $service_type = trim(filter_input(INPUT_POST, 'service_type', FILTER_SANITIZE_STRING));
    $branch_id = filter_input(INPUT_POST, 'branch_id', FILTER_VALIDATE_INT);
    $reservation_date = $_POST['reservation_date']; // Basic validation, consider more robust date validation

    // Basic validation check
    if (empty($name) || empty($phone) || empty($car_info) || empty($service_type) || !$branch_id || empty($reservation_date)) {
        header("Location: maintenance.php?status=error");
        exit();
    }

    // Get branch name
    $branch_stmt = $conn->prepare("SELECT name FROM branches WHERE id = ?");
    $branch_stmt->bind_param("i", $branch_id);
    $branch_stmt->execute();
    $branch_result = $branch_stmt->get_result();
    $branch_name = '';
    if ($branch_row = $branch_result->fetch_assoc()) {
        $branch_name = $branch_row['name'];
    }
    $branch_stmt->close();

    // Prepare and bind
    $stmt = $conn->prepare("INSERT INTO maintenance_reservations (name, phone, car_info, service_type, branch_id, reservation_date) VALUES (?, ?, ?, ?, ?, ?)");
    $stmt->bind_param("ssssis", $name, $phone, $car_info, $service_type, $branch_id, $reservation_date);

    if ($stmt->execute()) {
        // Send data to Odoo CRM
        try {
            $odoo = new OdooAPI();
            
            // Prepare lead data for Odoo
            $leadData = [
                'name' => 'حجز صيانة - ' . $name,
                'contact_name' => $name,
                'phone' => $phone,
                'description' => "حجز صيانة في فرع: {$branch_name}\nنوع الخدمة: {$service_type}\nمعلومات السيارة: {$car_info}\nتاريخ الحجز: {$reservation_date}",
                'source' => OdooConfig::LEAD_SOURCE_WEBSITE_MAINTENANCE,
                'branch_name' => $branch_name,
                'service_type' => $service_type,
                'car_info' => $car_info,
                'reservation_date' => $reservation_date
            ];
            
            // Create lead in Odoo
            $leadId = $odoo->createLead($leadData);
            
            if ($leadId) {
                // Create follow-up activity
                $odoo->createActivity(
                    $leadId, 
                    1, // Default activity type (adjust as needed)
                    'متابعة حجز الصيانة',
                    "العميل {$name} حجز صيانة {$service_type} في فرع {$branch_name} لسيارة {$car_info} في تاريخ {$reservation_date}"
                );
            }
        } catch (Exception $e) {
            // Log error but don't fail the booking
            error_log('Odoo integration error for maintenance booking: ' . $e->getMessage());
        }
        
        header("Location: maintenance.php?status=success");
    } else {
        header("Location: maintenance.php?status=error");
    }

    $stmt->close();
    $conn->close();
} else {
    header("Location: maintenance.php");
    exit();
}
?>
© 2026 GrazzMean