Zploit 0-Day Shell

:: Editing File: products_delete.php

<?php
// products_delete.php - Handles the deletion of a Product from the 'groups' table

require_once 'db.php'; 
require_once 'session.php';

// 1. Validate ID from URL
if (!isset($_GET['id']) || empty($_GET['id'])) {
    $_SESSION['error'] = "Error: Product ID is missing for deletion.";
    header("Location: products.php"); 
    exit;
}

$product_id = (int)$_GET['id'];
$success = false;
$product_name = "Unknown Product"; // Default name for feedback

// Start a transaction for data integrity
mysqli_begin_transaction($conn);

try {
    // 2. Fetch the current image path and name before deletion
    $old_image_path = null;
    $sql_fetch = "SELECT subheading, image FROM groups WHERE id = ?";
    $stmt_fetch = mysqli_prepare($conn, $sql_fetch);
    
    if ($stmt_fetch) {
        mysqli_stmt_bind_param($stmt_fetch, "i", $product_id);
        mysqli_stmt_execute($stmt_fetch);
        mysqli_stmt_bind_result($stmt_fetch, $product_name, $old_image_path);
        mysqli_stmt_fetch($stmt_fetch);
        mysqli_stmt_close($stmt_fetch);
    }

// 3. Prepare and Execute DELETE Query
    $sql_delete = "DELETE FROM groups WHERE id = ?";
    $stmt_delete = mysqli_prepare($conn, $sql_delete);

if ($stmt_delete) {
        mysqli_stmt_bind_param($stmt_delete, "i", $product_id);
        
        if (mysqli_stmt_execute($stmt_delete)) {
            // Commit the deletion from the database
            mysqli_commit($conn);
            $success = true;
            mysqli_stmt_close($stmt_delete);
        } else {
            throw new Exception("Database execution error: " . mysqli_stmt_error($stmt_delete));
        }
    } else {
        throw new Exception("Database preparation error: " . mysqli_error($conn));
    }

} catch (Exception $e) {
    // Rollback changes if anything failed
    mysqli_rollback($conn);
    $_SESSION['error'] = "Failed to delete product: " . $e->getMessage();
    header("Location: products.php");
    exit;
}

// 4. Delete File from Server (Only if database deletion was successful)
if ($success) {
    // Check if a path exists, the file exists on disk, and it's a file (not a directory)
    if (!empty($old_image_path) && file_exists($old_image_path) && is_file($old_image_path)) {
        // Attempt to delete the file. We do this outside the transaction so
        // file cleanup doesn't cause a rollback of the critical DB deletion.
        unlink($old_image_path); 
    }

$_SESSION['success'] = "Product **'{$product_name}'** (ID: {$product_id}) deleted successfully.🗑️";
    header("Location: products.php");
    exit;
}

mysqli_close($conn);