shell bypass 403
<?php
session_start();
include('../include/dbconnect.php');
$errMsg="";
if(isset($_POST["Sign_in"]))
{
$u_name=$_POST["u_name"];
$pwd=$_POST["pwd"];
$chk_usr_sql="SELECT * FROM login WHERE u_name='".$u_name."' AND pass=AES_ENCRYPT('".$pwd."','nplus')";
//die($chk_usr_sql);
$chk_usr_exe=mysqli_query($con,$chk_usr_sql);
if(mysqli_num_rows($chk_usr_exe) > 0 )
{
$_SESSION["User_session"]="hjkhdfhgghgfbchh";
$errMsg="";
$chk_usr_result=mysqli_fetch_array($chk_usr_exe);
$_SESSION["username"]=$chk_usr_result["u_name"];
echo "<script>
window.location.href='dashboard.php';
</script>";
}
else{
$errMsg='<div class="alert alert-danger errAlert navbar-fixed-top" id="errMsg">Incorrect Username or Password</div>';
}
}
if(isset($_POST["forgot_pwd"]))
{
$get_Id_sql="SELECT c_enquiry_mail FROM contact_us";
$get_Id_exe=mysqli_query($con,$get_Id_sql);
$get_Id_result=mysqli_fetch_array($get_Id_exe);
$mail_id=$get_Id_result["c_enquiry_mail"];
$input_mailId=$_POST["f_email"];
//echo $input_mailId;
if($mail_id != $input_mailId){
$errMsg='<div class="alert alert-danger errAlert navbar-fixed-top" id="errMsg">Email id you entered doesnot exists</div>';
}
else{
$get_pass_sql="SELECT u_name,AES_DECRYPT(pass,'nplus') AS upass FROM login";
$get_pass_exe=mysqli_query($con,$get_pass_sql);
$get_pass_result=mysqli_fetch_array($get_pass_exe);
$uname=$get_pass_result["u_name"];
$pass=$get_pass_result["upass"];
$subject ='Password Recovery Mail From Regis Marine';
$message ='Username : '.$uname;
$message .='Password : '.$pass;
$headers ='FROM : Regis Marine'.strip_tags($mail_id)."\r\n";
$headers .= "Reply-To: ". strip_tags($mail_id) . "\r\n";
$headers .= "MIME-Version: 1.0\r\n";
$headers .= "Content-Type: text/html; charset=ISO-8859-1\r\n";
$status=mail($mail_id, $subject, $message, $headers);
if($status)
{
$errMsg='<div class="alert alert-danger errAlert navbar-fixed-top" id="errMsg">Kindly Check Your Mail</div>';
}
else{
$errMsg='<div class="alert alert-danger errAlert navbar-fixed-top" id="errMsg">Error!!!Sorry for the inconvenience</div>';
}
}
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<!-- Meta, title, CSS, favicons, etc. -->
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title><?php echo TITLE; ?></title>
<link href="css/bootstrap.min.css" rel="stylesheet">
<!-- Font Awesome -->
<link rel="stylesheet" href="http://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.6.3/css/font-awesome.min.css">
<link href="css/font-awesome.min.css" rel="stylesheet">
<!-- Custom Theme Style -->
<link href="css/custom.min.css" rel="stylesheet">
</head>
<body class="login">
<?php echo $errMsg; ?>
<div>
<a class="hiddenanchor" id="signup"></a>
<div class="login_wrapper">
<div class="animate form login_form">
<section class="login_content">
<form method="post">
<h1>Login Form</h1>
<div>
<input type="text" class="form-control" name="u_name" placeholder="Username" required="" />
</div>
<div>
<input type="password" class="form-control" name="pwd" placeholder="Password" required="" />
</div>
<div>
<button class="btn btn-lg btn-login btn-block" name="Sign_in" type="submit">Sign in</button>
<!--<a class="btn btn-default submit" href="index.html">Log in</a>-->
<a class="reset_pass" data-toggle="modal" data-target="#myModal">Lost your password?</a>
</div>
<div class="clearfix"></div>
<div class="separator">
<div class="clearfix"></div>
<br />
</div>
</form>
</section>
</div>
</div>
<!-- Modal -->
<div aria-labelledby="myModalLabel" role="dialog" tabindex="-1" id="myModal" class="modal fade">
<div class="modal-dialog">
<div class="modal-content">
<div class="modal-header">
<button type="button" class="close" data-dismiss="modal">×</button>
<h4 class="modal-title">FORGOT PASSWORD?</h4>
</div>
<form action="" method="post">
<div class="modal-body">
<p>Enter your e-mail address to reset your password.</p>
<input type="email" name="f_email" placeholder="Email" class="form-control placeholder-no-fix" required />
</div>
<div class="modal-footer">
<!--<button data-dismiss="modal" class="btn btn-default" type="button">Cancel</button>-->
<button class="btn btn-primary" type="submit" name="forgot_pwd">Submit</button>
</div>
</form>
</form>
</div>
</div>
</div>
<!-- modal -->
</div>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js"></script>
<script src="http://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js"></script>
<script src="js/custom.min.js"></script>
</body>
</html>