Zploit 0-Day Shell

:: Editing File: tour_detalis.php

<?php 
include"header.php";
$ref = $_GET['ref'];
$ref_result ="SELECT * FROM tours WHERE ref='$ref' ";
$stmt1=$conn->query($ref_result);
$details = $stmt1->fetch();

$cat = $details['category_id'];
$cat_result ="SELECT * FROM category WHERE id='$cat' ";
$cat_stmt=$conn->query($cat_result);
$categoryData = $cat_stmt->fetch();

echo $categoryData['name'];

?>
	
          <section class="inner-area parallax-bg" data-background="images/bg/px-1.jpg" data-type="parallax" data-speed="3">
            <div class="container">
              <div class="section-content">
                <div class="row">
                  <div class="col-12">
                    <h4><?php echo $details['name']; ?> </h4>
					<p><a href="category.php">Tour </a> 
                    <a href="tour.php?ref=<?php echo $categoryData['ref'];?>"><?php echo $categoryData['name']; ?> Tour </a> - <?php echo $details['name'] ?></p>
                  </div>
                </div>
              </div>
            </div>
          </section>				
		    <section class=" boxContent">
				<div class="container">
					
						<center><h2 class="text-center" style="color:#ccaa6b"><?php echo $details['name']; ?></h2></center>
						<hr>
						<div class="row">
							<div class="col-sm-8 col-xs-6">
								<span class="price_value price_min pull-left" style="color: #ccaa6b;text-transform: initial;    font-size: 17px;"> <?php if(empty($details['day_offer'])) echo ""; else { echo $details['day_offer']; } ?></span>
							</div>
							
							<div class="col-sm-4 col-xs-6">
								<span class="price_value price_min pull-right" style="font-size: 18px; color:#4c8acb;font-weight: 700;text-transform: uppercase;"><i class="fa fa-calendar"></i> <?php echo $details['days']; ?></span>
							</div>
						</div>
						<br>
					
					
						<?php  $tours_id=$details['id']; 
									$gallery_result ="SELECT * FROM tour_image WHERE tours_id='$tours_id'";
									$gallery_stmt1=$conn->query($gallery_result);
									$gallery = $gallery_stmt1->fetchall(); 
									
									$count_img = count($gallery);
									if($count_img == '1')
									{ 	
									
										foreach ($gallery as $gallery1) { ?>
										<img src="upload/tour/<?php echo $gallery1['image_name'];?>" alt="">
										
										
									<?php }  } else
									{ ?>
										
									
									
					<div class="row">
						  <body style="padding:0px; margin:0px; background-color:#fff;font-family:arial,helvetica,sans-serif,verdana,'Open Sans'">
								<script src="js/jssor.slider-28.0.0.min.js" type="text/javascript"></script>
								<script type="text/javascript">
									window.jssor_1_slider_init = function() {

var jssor_1_SlideoTransitions = [
										  [{b:-1,d:1,ls:0.5},{b:0,d:1000,y:5,e:{y:6}}],
										  [{b:-1,d:1,ls:0.5},{b:200,d:1000,y:25,e:{y:6}}],
										  [{b:-1,d:1,ls:0.5},{b:400,d:1000,y:45,e:{y:6}}],
										  [{b:-1,d:1,ls:0.5},{b:600,d:1000,y:65,e:{y:6}}],
										  [{b:-1,d:1,ls:0.5},{b:800,d:1000,y:85,e:{y:6}}],
										  [{b:-1,d:1,ls:0.5},{b:500,d:1000,y:195,e:{y:6}}],
										  [{b:0,d:2000,y:30,e:{y:3}}],
										  [{b:-1,d:1,rY:-15,tZ:100},{b:0,d:1500,y:30,o:1,e:{y:3}}],
										  [{b:-1,d:1,rY:-15,tZ:-100},{b:0,d:1500,y:100,o:0.8,e:{y:3}}],
										  [{b:500,d:1500,o:1}],
										  [{b:0,d:1000,y:380,e:{y:6}}],
										  [{b:300,d:1000,x:80,e:{x:6}}],
										  [{b:300,d:1000,x:330,e:{x:6}}],
										  [{b:-1,d:1,r:-110,sX:5,sY:5},{b:0,d:2000,o:1,r:-20,sX:1,sY:1,e:{o:6,r:6,sX:6,sY:6}}],
										  [{b:0,d:600,x:150,o:0.5,e:{x:6}}],
										  [{b:0,d:600,x:1140,o:0.6,e:{x:6}}],
										  [{b:-1,d:1,sX:5,sY:5},{b:600,d:600,o:1,sX:1,sY:1,e:{sX:3,sY:3}}]
										];

@keyframes jssorl-009-spin {
										from {
											transform: rotate(0deg);
										}

to {
											transform: rotate(360deg);
										}
									}
									/*jssor slider bullet skin 132 css*/
									.jssorb132 {position:absolute;}
									.jssorb132 .i {position:absolute;cursor:pointer;}
									.jssorb132 .i .b {fill:#fff;fill-opacity:0.8;stroke:#000;stroke-width:1600;stroke-miterlimit:10;stroke-opacity:0.7;}
									.jssorb132 .i:hover .b {fill:#000;fill-opacity:.7;stroke:#fff;stroke-width:2000;stroke-opacity:0.8;}
									.jssorb132 .iav .b {fill:#000;stroke:#fff;stroke-width:2400;fill-opacity:0.8;stroke-opacity:1;}
									.jssorb132 .i.idn {opacity:0.3;}

.jssora051 {display:block;position:absolute;cursor:pointer;}
									.jssora051 .a {fill:none;stroke:#fff;stroke-width:360;stroke-miterlimit:10;}
									.jssora051:hover {opacity:.8;}
									.jssora051.jssora051dn {opacity:.5;}
									.jssora051.jssora051ds {opacity:.3;pointer-events:none;}
								</style>
								<svg viewbox="0 0 0 0" width="0" height="0" style="display:block;position:relative;left:0px;top:0px;">
									<defs>
										<filter id="jssor_1_flt_1" x="-50%" y="-50%" width="200%" height="200%">
											<feGaussianBlur stddeviation="4"></feGaussianBlur>
										</filter>
										<radialGradient id="jssor_1_grd_2">
											<stop offset="0" stop-color="#fff"></stop>
											<stop offset="1" stop-color="#000"></stop>
										</radialGradient>
										<mask id="jssor_1_msk_3">
											<path fill="url(#jssor_1_grd_2)" d="M600,0L600,400L0,400L0,0Z" x="0" y="0" style="position:absolute;overflow:visible;"></path>
										</mask>
									</defs>
								</svg>
								<div id="jssor_1" style="position:relative;margin:0 auto;top:0px;left:0px;width:1600px;height:560px;overflow:hidden;visibility:hidden;">
									
									<div data-u="loading" class="jssorl-009-spin" style="position:absolute;top:0px;left:0px;width:100%;height:100%;text-align:center;background-color:rgba(0,0,0,0.7);">
										<img style="margin-top:-19px;position:relative;top:50%;width:38px;height:38px;" src="img/spin.svg" />
									</div>
									<div data-u="slides" style="cursor:default;position:relative;top:0px;left:0px;width:1600px;height:560px;overflow:hidden;">
									
											<?php  $tour_id=$details['id']; 
												$img_result ="SELECT * FROM tour_image WHERE tours_id='$tour_id'";
												$img_stmt1=$conn->query($img_result);
												$img_all = $img_stmt1->fetchall(); 
												foreach ($img_all as $img) { ?>
										<div>
											<img data-u="image" data-src="upload/<?php echo $details['ref'] ?>/<?php echo $img['image_name']; ?>" />
										</div>
										
										<?php } ?>
												
												
									</div><a data-scale="0" href="https://www.jssor.com" style="display:none;position:absolute;">slider html</a>
									
									<div data-u="navigator" class="jssorb132" style="position:absolute;bottom:24px;right:16px;" data-autocenter="1" data-scale="0.5" data-scale-bottom="0.75">
										<div data-u="prototype" class="i" style="width:12px;height:12px;">
											<svg viewbox="0 0 16000 16000" style="position:absolute;top:0;left:0;width:100%;height:100%;">
												<circle class="b" cx="8000" cy="8000" r="5800"></circle>
											</svg>
										</div>
									</div>
									
									<div data-u="arrowleft" class="jssora051" style="width:55px;height:55px;top:0px;left:25px;" data-autocenter="2" data-scale="0.75" data-scale-left="0.75">
										<svg viewbox="0 0 16000 16000" style="position:absolute;top:0;left:0;width:100%;height:100%;">
											<polyline class="a" points="11040,1920 4960,8000 11040,14080 "></polyline>
										</svg>
									</div>
									<div data-u="arrowright" class="jssora051" style="width:55px;height:55px;top:0px;right:25px;" data-autocenter="2" data-scale="0.75" data-scale-right="0.75">
										<svg viewbox="0 0 16000 16000" style="position:absolute;top:0;left:0;width:100%;height:100%;">
											<polyline class="a" points="4960,1920 11040,8000 4960,14080 "></polyline>
										</svg>
									</div>
								</div>
								<script type="text/javascript">jssor_1_slider_init();
								</script>
								
							</body>
					</div>
					<?php } ?>
					
					<div class="row">
							<section>
							  <div class="container">
								<div class="section-content">
								  <div class="row">
									<div class="col-md-12">
									  <ul class="nav nav-tabs shop-tab-menu">
										  <li class="nav-item"><a href="" data-target="#Itinerary" data-toggle="tab" class="nav-link active">Itinerary</a></li>
										  <li class="nav-item"><a href="" data-target="#Inclusion" data-toggle="tab" class="nav-link ">Inclusion / Exclusion</a></li>
										  <li class="nav-item"><a href="" data-target="#Payment" data-toggle="tab" class="nav-link ">Payment Information</a></li>
										  <li class="nav-item"><a href="" data-target="#Contact" data-toggle="tab" class="nav-link">Contact Us</a></li>
									  </ul>
									  <br>
									  <div class="tab-content shop-tab-content">
										
										<div id="Itinerary" class="tab-pane fade active show">
											
											
											<?php if(empty($details['Itinerary'])) echo ""; else { echo $details['Itinerary']; } ?>
											
										</div>
										<div id="Inclusion" class="tab-pane fade">
											
											<?php if(empty($details['Inclusions'])) echo ""; else { echo $details['Inclusions']; } ?>
										</div>
										<div id="Payment" class="tab-pane fade">
											
												<p><strong>Reservation Policy</strong></p>
												<p>▸ Confirmation of Hotel Rooms / Train & Air Tickets is subject to the availability.</p>
												<br>
												<p><strong>Payment</strong></p>
												<p>▸ Confirmation payment of 50 % to be deposited at any branch of “Kotak Mahindra Bank”</p>
												<p><strong>Bank:</strong> Kotak Mahindra Bank</p>
												<p><strong>Holder:</strong> Marz Tours And Travels</p>
												<p><strong>Account Number:</strong> 5213202418</p>
												<p><strong>Branch Name:</strong> Mandvi Mumbai Branch</p>
												<p><strong>IFSC Code:</strong>   KKBK0001386</p>
												<br>
												<p>▸ Kindly intimate the payment details to us as well as retain copy of DD / Bank Pay-in Slip.</p>
												<br>
												<p>▸ Balance payment to be made 30 days prior to date of journey.</p>

</div>
										
										<div id="Contact" class="tab-pane fade">
											<style>
												#Contact label{ color: #d2ae6d; }
											</style>
											<form action="" method="post" class="wpcf7-form" novalidate="novalidate">
												<div style="display: none;">
												<input type="hidden" name="_wpcf7" value="4">
												<input type="hidden" name="_wpcf7_version" value="5.0.2">
												<input type="hidden" name="_wpcf7_locale" value="en_US">
												<input type="hidden" name="_wpcf7_unit_tag" value="wpcf7-f4-p3886-o1">
												<input type="hidden" name="_wpcf7_container_post" value="3886">
												</div>
												
												<div class="form-group">
													<label for="email">  Your Name : *</label>
													<input type="text" name="your-name" class="form-control" value=""   aria-required="true" aria-invalid="false" required>  
												</div>
												<div class="row">
													<div class="col-sm-6">
														<div class="form-group">
															<label for="email">  Your Contact No : *</label>
															<input type="text" name="your-name" class="form-control" value=""  aria-required="true" aria-invalid="false" required>  
														</div>
													</div>
													<div class="col-sm-6">
														<div class="form-group">
															<label for="email">  Your Email ID : *</label>
															<input type="email" name="your-name" class="form-control" value=""   aria-required="true" aria-invalid="false" required>  
														</div>
													</div>
												</div>
												<div class="form-group">
													<label for="email">  Your Message :</label>
													
													<textarea class="form-control" rows="5" style="1px solid #ced4da;"></textarea>
												</div>
												<input type="submit" class="btn btn-primary" style="background: #ccaa6b;padding: 5px 10px 10px 10px;margin-top: 10px; height: 35px;border: none;">
												
											</form>
										</div>
									  </div>
									</div>
								  </div>
								</div>
							  </div>
							</section>

</div>
				</div>
			</section>
		  <?php include"footer.php"?>