shell bypass 403

GrazzMean Shell

Uname: Linux server.thebazaar99.com 5.14.0-687.17.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Jun 22 07:21:26 EDT 2026 x86_64
Software: Apache
PHP version: 8.3.32 [ PHP INFO ] PHP os: Linux
Server Ip: 163.227.92.254
Your Ip: 216.73.217.24
User: gutlooks (1003) | Group: gutlooks (1005)
Safe Mode: OFF
Disable Function:
exec,passthru,shell_exec,system

name : view-inventory.php
 
			<?php $this->load->view('admin/sidebar.php');?>
		</div>
		<div class="content-right">
			<?php $this->load->view('admin/header.php');?>
			<div class="main-content">
				<div class="dash-block">
					<?=$this->session->flashdata("success_msg")?>
					<h5 class="border-bottom pb-3">View Inventory <a href="<?=base_url('admin/dashboard')?>"><button type="button" class="btn btn-success btn-sm m-2">Dashboard</button></a></h5>

					<div class="form-element mt-2">
						<table class="table table-bordered" id="example">
						<thead>	
							<tr>
								<th>SNo </th>
								<th>Image</th>
								<th>Product SKU</th>
								<th>Product Name</th>
								<th>Stock Level</th>
								
							</tr>
						</thead>
						<tbody>	
							<?php 
                                                        $product_res = $this->Curd->all_fetcher_order("tb_product","DESC");
							if(isset($product_res) && $product_res==true):
								$sno = 1;
								foreach($product_res as $row){
									
$gallery_res = $this->Curd->fetch_where("tb_gallery",array("name"),array("product_id"=>$row->id));
//$productQty = $this->Curd->fetch_where('tb_product_price',array('*'),array('product_id'=>$row->id));
                                                                        
                                                                        
    $this->db->select('pr.*,tb_colors.name as color_name');
    $this->db->from('tb_product_price pr');
    $this->db->where('pr.product_id',$row->id);
    $this->db->join('tb_colors', 'pr.color_id = tb_colors.id', 'left'); 
    $query55 = $this->db->get();
    $productQty= $query55->result();
//      echo $this->db->last_query();
      ?>
								<tr>
									<td><?=$sno++?></td>
									<td>
    <!--<img src="<?=base_url('uploads/gallery/medium/'.$gallery_res[0]->name)?>" width="50px">-->
     <img src="<?=base_url('uploads/gallery/'.$gallery_res[0]->name)?>" width="50px">
    </td>
    <td><a href="<?=base_url('admin/delete_product/'.base64_encode($row->id))?>" onclick="return confirm('Are you sure you want to delete this item?');"><?=$row->sku?></a></td>
									<td><?=$row->title?></td>
									<td>
										<table width="500">
											<tr>
												<td>Size</td>
												<td>Color</td>
												<td>Sale Price</td>
												<td>Qty</td>
												<td>Add Qty</td>
												<td>Action</td>
											</tr>
										<?php 
										if($productQty==true):
											foreach($productQty as $qrow):?>
											<tr>
												<td><?=$qrow->weight?> </td>
												<td><?=$qrow->color_name?> </td>
												<td><?=$qrow->reg_sale_price?></td>
												<td><?=$qrow->qty?></td>
												<td><input type="text" id="qty"  size="2"></td>
												<td><a href="#"><button type="button" class="btn btn-success btn-sm qty_status" id="<?=$qrow->id?>">Save</button></td>
											</tr>
										<?php endforeach; endif;?>	
										</table>
									</td>
								</tr>	
							<?php	
								}
							endif;
							?>
						</tbody>	
						</table>
					</div>
				</div>
			</div>
			<?php $this->load->view('admin/footer');?>
		</div>
	</div>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
<script type="text/javascript" src="<?=base_url('admin_assets/js/bootstrap.min.js')?>"></script>
<script type="text/javascript" src="<?=base_url('admin_assets/js/select2.min.js')?>"></script>
<script type="text/javascript" src="<?=base_url('admin_assets/js/custom.js')?>"></script>
<script src="<?=base_url('admin_assets/js/css3-animate-it.js')?>"></script>
<script type="text/javascript" src="https://cdn.datatables.net/1.10.19/js/jquery.dataTables.min.js"></script>
<script type="text/javascript" src="https://cdn.datatables.net/1.10.19/js/dataTables.bootstrap4.min.js"></script>
<script type="text/javascript">
$(document).ready(function () {
  	$('#example').DataTable();
});
</script>
<script type="text/javascript">
$(".qty_status").click(function() {
	var con = confirm("Are you sure you want to update it");
	var id=$(this).attr("id");
	var qty = $(this).closest("tr").find('#qty').val();
	if(con==true){
		$.ajax({
			url:"<?=base_url('admin/add_product_stock')?>",
			method:"post",
			data:{"id_for_qty":id,"qty":qty},
			dataType:"json",
			success: function(res){//for response
				if(res.status==1){
					//$("#qty_cell").text(res.output);
					location.reload();
				}else if(res.status==0){
					alert(res.msg);
					return false;
				}
			}
		});
	}else{
		alert("Internal Problem");
		return false;
	}
	
});

</script>
</body>
</html>

© 2026 GrazzMean