Fallagassrini Bypass Shell

<?
//0=>id
//1=>droits
//2=>mail
//3=>password
//4=>nom

// FORCAGE DU LOUGOUT
if ($_GET['logout']==1)
{
	$_SESSION[]	=	"";
	session_unset();
	session_destroy();
    setcookie('cookiegestionmyreco', '',time() - 3600);
	
}
$remember_me_recuperation	= 	"1";

//////////////////////////////////////////////////////////////////
// AUTHENTIFICATION INITIALE, GENERATION COOKIE ET VARIABLE SESSION
//////////////////////////////////////////////////////////////////

$resultat					=	"";
if ($mail_recuperation && $password_recuperation)
	{
	$resultat = "Accès non autorisé";
	$num = $db->get_var("select count(id) from heb where statut=1 AND login = '$mail_recuperation' AND password = '$password_recuperation'");
	if ($num!=0)
		{
		$myquery						=   "select id,login,password,token  from heb where login = '$mail_recuperation' AND password = '$password_recuperation'";
		$marequete		 				=   $db->get_row($myquery);
		$_SESSION['connect_id']			=	$marequete->id;
		$_SESSION['connect_droit']		= 	1;
		$_SESSION['connect_mail']		=	$mail_recuperation;
		$_SESSION['connect_nom']		=	$marequete->token;
		
		//////////////////
		//INSERTION COOKIE
		//////////////////
			if ($remember_me_recuperation)
			{
			$cookie = base64_encode ("$marequete->id:"."$marequete->type_id:"."$mail_recuperation:".$password_recuperation);
			setcookie('cookiegestionmyreco',$cookie,time() + $lifetime);
			}
		header("Refresh:0; url=index.php?token=".$marequete->token);exit;
		}
	}	

/////////////////////////////////////////////////////////////
// SI UN COOKIE EXISTE, ON REMPLIT LES VARIABLES DE SESSION//
/////////////////////////////////////////////////////////////


if ($_COOKIE['cookiegestionmyreco'] && $_SESSION['connect_id_origine']=='') 
	{
	$cookie 		= $_COOKIE['cookiegestionmyreco'];
	$content 		= base64_decode ($cookie);
	$tableau_cookie = explode (':', $content);
	$verification = "select count(id) from heb where statut=1 AND login = '".$tableau_cookie[2]."' AND password = '".$tableau_cookie[3]."'";
	if ($verification)
		{
		$myquery						=	"select id,login,password,token  from heb where id = ".$tableau_cookie[0];
		$marequete 						= 	$db->get_row($myquery);
		$_SESSION['connect_id']			=	$marequete->id;
		$_SESSION['connect_droit']		= 	1;
		$_SESSION['connect_mail']		=	$mail_recuperation;
		$_SESSION['connect_nom']		=	$marequete->token;
		}
	}
///////////////////////////////////////////////////
// SI LA SESSION EST VIDE ALORS ON EST DECONNECTE//
///////////////////////////////////////////////////

if ($page!='login' && $_SESSION['connect_id']=='')
	{
	//echo "Vous avez été déconnecté!<br>";
	//echo "<a href='login.php'>Login</a>";
	//exit;
	header("Refresh:0; url=login.php");exit;
	}
?>