<?php

if(!defined("__DB_INDEX__")) die;
if($_SERVER["REMOTE_ADDR"] !== "127.0.0.1") die("Sorry, not yet opened");

include "db.php";

if ($action === "db_version") {
    $result = query("select @@version");
    $row = $result->fetch_array();

    die("$row[0]");
}

...
?>

<?php

$action = isset($_GET["action"]) ? $_GET["action"] : "";
$arg = $_GET["arg"] ?? "";

<?php 
include_once "common.php";

if ($action === "phpinfo") {
    phpinfo();
}
if ($action === "ping") {
    list($url, $path) = @explode("|", $arg);

    if (strncmp($url, "http://", 7) !== 0)
        die("only http support");
    
    $host = substr($url, 7);
    if ($host != "cce.cstec.kr" && !preg_match("/\.cce\.cstec\.kr$/", $host)) 
        die("no hack");
    if (preg_match("/[^A-Za-z0-9-._%?=&\/]/", $path))
        die("no hack");

    // Double check
    $real_url = "http://{$host}/{$path}";
    $parse_url = parse_url($real_url); 
    
    if ($parse_url["host"] !== "cce.cstec.kr" && !preg_match("/\.cce\.cstec\.kr$/", $parse_url["host"])) 
        die("no hack2");
    if (preg_match("/[^A-Za-z0-9-._%?=&\/]/", $parse_url["path"]))
        die("no hack2");
    
    // send ping
    $fp = fsockopen($host, 80);
    if(!$fp)
        die("error");

    $body = "GET /{$path} HTTP/1.1\r\n";
    $body .= "Host: internal-ping.cce.local\r\n";
    $body .= "Connection: Close \r\n\r\n";

    fwrite($fp, $body);
    while (!feof($fp)) {
        echo str_replace("\n", "<br>", htmlentities(fgets($fp, 2048)));
    }
    fclose($fp);
}

if (!strncmp($action, "db_", 3)) {
    define("__DB_INDEX__", 1);
    include "db_action.php";
    die;
}
?>

<?php
if(!defined("__DB_INDEX__")) die;
if($_SERVER["REMOTE_ADDR"] !== "127.0.0.1") die("Sorry, not yet opened");

include "db.php";

... 

if ($action === "db_show_event_detail") {
    $event_name = $_GET["db_arg_event_name"];

    if(preg_match("/(as|,|where|limit)/i", $event_name))
        die("no hack");

    // sql 
    $event_name = addslashes($event_name);
    $result = @query("select * from events where name = '{$event_name}'");

    if(!$result)
        die("no hack");

    $row = $result->fetch_assoc();
    if($row["writer"] !== sha1($_GET["db_arg_writer"]))
        die("no hack");

    if($row["pw"] !== sha1($_GET["db_arg_password"]))
        die("no hack");

    die($row["body"]);
}

<?php

function connect() {
    $dbserver = "db";
    $dbconn = mysqli_connect($dbserver, "root", "veryveryhardpassword", "ccend");
    return $dbconn;
}

function query($sql) {
    // Special thanks to gnuboard :)
    $sql = trim($sql);
    $sql = preg_replace("#^select.*from.*[\s\(]+union[\s\)]+.*#i ", "select XXX", $sql);
    $sql = preg_replace("#^select.*from.*where.*`?information_schema`?.*#i", "select XXX", $sql);

    $conn = connect();
    return $conn->query($sql);
}

<?php

    session_start();
    require_once "lib.php";
    require_once "config/dbconn.php";

    if ($_SESSION["level"] > 900 && $_SESSION["username"] === "admin") {
        if ($_GET['mode'] === "debug_mode") {
            debug($_GET["debug"]);
        }
    } else if ($_SESSION["level"] == 1)  {
        session_write("level",2);
    } else {
        session_write("username", (isset($_REQUEST["username"]) && $_REQUEST["username"] !== "admin") ? $_REQUEST["username"] : "guest");
        session_write("level", 1);
    }
?>

<?php

    session_start();
    require_once "lib.php";
    require_once "config/dbconn.php";

    if (isset($_POST["username"]) && isset($_POST["password"])) {
        $query = "SELECT userid, password FROM user WHERE userid = '".bin2hex($_POST["username"])."' and password = '".bin2hex($_POST["password"])."';";
        $data = Array();
        try {
            $result = $mysqli->query($query);
            $data = mysqli_fetch_array($result);
        } catch(Exception $e) {
        }
        isFirstLoginAttempt();
        if (isset($data) && $data[0] === bin2hex($_POST["username"]) && $data[1] === bin2hex($_POST["password"]) && !$_SESSION['first_attempt']) {
            session_write("isLogin", true);
            if ($_POST["username"] === "admin" && $_SESSION['first_attempt']) {
                $_SESSION["level"] = 99999;
                $_SESSION["username"] = "admin";
                header("Location: /index.php");
            } else {
                print_error("Smart admins never enter the wrong password :p");
            }
        } else {
            print_error("Incorrect Password");
        }
    } else {
        header("Location: /index.php");
    }
?>

<?php
    error_reporting(0);

    function global_filter($input) {
        $pattern = '/[^a-zA-Z0-9\/\-]/';

        if (is_array($input)) {
            foreach ($input as $key => $value) {
                global_filter($value); 
            }
        } else {
            if (preg_match($pattern, $input)) {
                die("Invalid character");
            }
        }
    }

    function session_write($key, $value) {
        $_SESSION[$key] = $value;
        session_commit();
        session_start();
    }

    function isFirstLoginAttempt() {
        if (!isset($_SESSION["first_attempt"])) {
            session_write("first_attempt", true);
        } else {
            session_write("first_attempt", false);
        }
    }
    ...
    global_filter($_REQUEST);
?>

<?php
    session_start();
    require_once "lib.php";
    require_once "config/dbconn.php";

    if (isset($_POST["username"]) && isset($_POST["password"])) {
        $query = "SELECT userid, password FROM user WHERE userid = '".bin2hex($_POST["username"])."' and password = '".bin2hex($_POST["password"])."';";
        $data = Array();
        try {
            $result = $mysqli->query($query);
            $data = mysqli_fetch_array($result);
        } catch(Exception $e) {
        }
        isFirstLoginAttempt();
        if (isset($data) && $data[0] === bin2hex($_POST["username"]) && $data[1] === bin2hex($_POST["password"]) && !$_SESSION['first_attempt']) {
            session_write("isLogin", true);
            if ($_POST["username"] === "admin" && $_SESSION['first_attempt']) {
                $_SESSION["level"] = 99999;
                $_SESSION["username"] = "admin";
                header("Location: /index.php");
            } else {
                print_error("Smart admins never enter the wrong password :p");
            }
        } else {
            print_error("Incorrect Password");
        }
    } else {
        header("Location: /index.php");
    }
?>