Zploit 0-Day Shell

:: Editing File: web_process.php

<?php  
include "param.php"; 
include "func.php"; 
include "chk_login.php"; 
if (chp('LVL') == 1) 
{ 
    if (chp('C_TYPE') == "EDIT") 
    { 
           if (chp('new_pass') != "" && strlen(chp('new_pass')) > 5) 
           { 
                $QRY_ad = qry_run("Select * from tbl_admin"); 
                if (num_rec($QRY_ad) > 0) 
                { 
                    $qrad = fetch_rec($QRY_ad); 
                    if (md5(sha1('My'.md5(chp('old_pass')))) == $qrad['ppass']) 
                    {
                        $UPD_ad = qry_run("Update tbl_admin Set plogin = '".md5('admin')."',ppass = '".md5(sha1('My'.md5(chp('new_pass'))))."'"); 
						header("Location: web_setting.php?UP=Y"); 
						die;
                    }else{ 
                        header("Location: web_setting.php?OLD=Y"); 
                        die; 
                    } 
                } 
            }
            header("Location: web_setting.php?UP=N"); 
            die;     
    } 
	if (chp('C_TYPE') == "ADMIN") 
    { 
			if (chp('email_to') != "" && chp('phone') != "") 
			{ 
			   $UPD_ad = qry_run("Update tbl_webs Set email_to = '".chp('email_to')."',phone = '".chp('phone')."'"); 
			}
		   	$img1 = "";
			$sub_path = '../data/';
			$pic1 = "pop_up.";
			if (ch_file('pop_image') == "Yes")
			{
				$ext = do_file('pop_image',$pic1,$sub_path);
				if ($ext == "No")
				{
					$img1 = "";
				}else{
					$img1 = $pic1.$ext;
					$UPD_ad = qry_run("Update tbl_webs Set pop_image = '".$img1."'");
				}
			}
            $pic1 = "1_home_BG.";
			if (ch_file('BAN_image') == "Yes")
			{
				$ext = do_file('BAN_image',$pic1,$sub_path);
				if ($ext == "No")
				{
					$img1 = "";
				}else{
					$img1 = $pic1.$ext;
					$UPD_ad = qry_run("Update tbl_webs Set HomeBannerImage = '".$img1."'");
				}
			}
			$UPD_ad = qry_run("Update tbl_webs Set pop_status = '".chp('pop_status')."',popup_title = '".chp('popup_title')."',SpecialProductsTitle = '".chp('SpecialProductsTitle')."',WelcomeMessage = '".chp('WelcomeMessage')."'");
           header("Location: admin_setting.php?UP=Y"); 
           die;     
    }
} 
?>