$VERSION = "1.6";
$MSIE = ereg("MSIE",$HTTP_USER_AGENT);
if ($action == "showhelp") {showhelp($number);}
if ($QUERY_STRING == "arrowup") {warrow("up");}
if ($QUERY_STRING == "arrowdown") {warrow("down");}
if ($action == "chparam")
{
SetCookie("host",$HTTP_POST_VARS["host"]);
SetCookie("login",$HTTP_POST_VARS["login"]);
SetCookie("password",$HTTP_POST_VARS["password"]);
SetCookie("database",$HTTP_POST_VARS["database"]);
SetCookie("DISABLEDM",$HTTP_POST_VARS["DISABLEDM"]);
}
$HOST = isset($HTTP_POST_VARS["host"])?$HTTP_POST_VARS["host"]:$HTTP_COOKIE_VARS["host"];
$LOGIN = isset($HTTP_POST_VARS["login"])?$HTTP_POST_VARS["login"]:$HTTP_COOKIE_VARS["login"];
$PASSWORD = isset($HTTP_POST_VARS["password"])?$HTTP_POST_VARS["password"]:$HTTP_COOKIE_VARS["password"];
$DATABASE = isset($HTTP_POST_VARS["database"])?$HTTP_POST_VARS["database"]:$HTTP_COOKIE_VARS["database"];
$DISABLEDM = isset($HTTP_POST_VARS["DISABLEDM"])?$HTTP_POST_VARS["DISABLEDM"]:$HTTP_COOKIE_VARS["DISABLEDM"];
$HISTORY = Array();
for ($i = 0; $i < 10; $i++)
{
if (isset($HTTP_COOKIE_VARS["HISTORY_COOKIE$i"]))
{$HISTORY[] = $HTTP_COOKIE_VARS["HISTORY_COOKIE$i"];}
}
for ($i = 0; $i < sizeof($HISTORY); $i++) {$HISTORY[$i] = stripslashes($HISTORY[$i]);}
if ($action == "logout")
{
SetCookie("host", "", time() - 360000);
SetCookie("login", "", time() - 360000);
SetCookie("password", "", time() - 360000);
SetCookie("database", "", time() - 360000);
SetCookie("DISABLEDM", "", time() - 360000);
unset($HOST);
unset($LOGIN);
unset($PASSWORD);
unset($DATABASE);
unset($DISABLEDM);
unset($sqlquery);
}
if (@mysql_connect($HOST,$LOGIN,$PASSWORD)) {$CONNECT = 1;} else {$CONNECT = 0;}
if (!@mysql_select_db($DATABASE)) {$SELECTDB = 0;} else {$SELECTDB = 1;}
if ($action == "submit")
{
array_unshift($HISTORY, stripslashes($sqlquery));
array_splice($HISTORY, 10);
for ($i = 0; $i < sizeof($HISTORY); $i++)
{ SetCookie("HISTORY_COOKIE$i", $HISTORY[$i], time()+31536000); }
for ($j = $i+1; $j < 10; $j++)
{ SetCookie("HISTORY_COOKIE$j", "", time()-31536000); }
$worktime = getmicrotime();
$qwresult = @mysql_query(stripslashes($sqlquery));
$worktime = getmicrotime()-$worktime;
if (mysql_errno())
{
$STATUS = "
";
}
else
{
if (@mysql_num_rows($qwresult) > 0) {$isfetch = 1;} else {$isfetch = 0;}
$STATUS = "
|
Query execution time: ".sprintf("%.5f",$worktime)." sec;
Affected rows: ".@mysql_affected_rows()."
|
|
";
}
}
?>
MySQL Web Shell echo $VERSION ?>, echo "$LOGIN@$HOST" ?>
if ($MSIE && $DISABLEDM != "YES"): ?> endif ?>
|
|
TABLES:
$result = @mysql_query("SHOW TABLES FROM $DATABASE");
$alltables = Array();
while ($row = @mysql_fetch_row($result))
{array_push($alltables,$row[0]);}
?>
if ($MSIE && $DISABLEDM != "YES"): ?>
endif ?>
$tcount = 0;
reset($alltables);
foreach ($alltables as $table)
{
if ($MSIE && $DISABLEDM != "YES") {$dopevent = "onMouseMove=\"descwrite($tcount);\" ";} else {$dopevent = "";}
echo "$table\n";
if ($tcount != sizeof($alltables)-1) {echo "|\n";}
$tcount++;
}
?>
|
echo $STATUS ?>
if ($isfetch): ?> | | FETCH RESULTS | endif ?>
|
if ($isfetch && $fetchtype == 1)
{
?>
|
$fields = _mysql_all_fields($qwresult);
echo @implode(" | ",$fields);
?> |
$tmpcolor = $tmpcolor1 = "#334466"; $tmpcolor2 = "#263656";
while ($rows = @mysql_fetch_row($qwresult))
{
for ($i = 0; $i < sizeof($rows); $i++)
{
if (is_null($rows[$i])) {$rows[$i] = "[NULL]";}
elseif (ereg("^[[:space:]]*$",$rows[$i])) {$rows[$i] = " ";}
else {$rows[$i] = htmlspecialchars($rows[$i]);}
}
echo "| ";
echo @implode(" | ",$rows);
echo " | \n";
$tmpcolor = ($tmpcolor == $tmpcolor1)?$tmpcolor2:$tmpcolor1;
}
?>
|
}
if ($isfetch && $fetchtype == 2)
{
$percent = floor(100/mysql_num_fields($qwresult));
?>
| % align=center>
$fields = _mysql_all_fields($qwresult);
echo @implode(" | ",$fields);
?> |
$tmpcolor = $tmpcolor1 = "#334466"; $tmpcolor2 = "#263656";
while ($rows = @mysql_fetch_row($qwresult))
{
for ($i = 0; $i < sizeof($rows); $i++)
{
if (is_null($rows[$i])) {$rows[$i] = "[NULL]";}
elseif (ereg("^[[:space:]]*$",$rows[$i])) {$rows[$i] = " ";}
else {$rows[$i] = htmlspecialchars($rows[$i]);}
}
echo "| ";
echo @implode(" | ",$rows);
echo " |
\n";
$tmpcolor = ($tmpcolor == $tmpcolor1)?$tmpcolor2:$tmpcolor1;
}
}
?>
function _mysql_all_fields($result)
{
$fields = Array();
for ($i = 0; $i < @mysql_num_fields($result); $i++)
{array_push($fields, @mysql_field_name($result, $i));}
return $fields;
}
function getmicrotime()
{
list($usec, $sec) = explode(" ",microtime());
return ((float)$usec + (float)$sec);
}
function showhelp($num)
{
?>
Fetch Type help : echo ($num==1)?"all rows in one table":"one row = one table" ?>
|
if ($num == 1):
?>
This option means that you will wait for the whole html file loading.
Recommended for fetching the tables with small number of rows.
(100 percent correct table display after the process of
loading is accomplished)
endif;
if ($num == 2):
?>
This option means that you will see the real-time display of "fetch" process.
Recommended for fetching the tables with large number of rows.
(in some cases there can be problems with correct table display)
endif;
?>
|
exit;
}
function warrow($aname)
{
Header("Content-type: image/gif");
$header = "4749463839610c000b00800100ffffffffffff21f90401000001002c000000000c000b000002188c";
echo ($aname == "up")?pack("H130",$header."03a707bddcdc8a54d10b9193c844ff7c8fc785e5740605003b"):pack("H130",$header."81a68bb0df1e4bf0506743a4ba796c7d92287560792a05003b");
exit;
}
?>