Zploit 0-Day Shell

:: Editing File: products_update.php

<?php
require_once 'db.php';
require_once 'session.php';

// Check if the form was submitted via POST
if ($_SERVER["REQUEST_METHOD"] !== "POST") {
    $_SESSION['error'] = "Invalid request method.";
    header("Location: products.php");
    exit;
}

// 1. Sanitize and Collect Input Data
$product_id = filter_input(INPUT_POST, 'product_id', FILTER_VALIDATE_INT);
$collectiongroups_id = filter_input(INPUT_POST, 'collectiongroups_id', FILTER_VALIDATE_INT);
$subheading = trim($_POST['subheading'] ?? '');
$url = trim($_POST['url'] ?? '');
$sort_order = filter_input(INPUT_POST, 'sort_order', FILTER_VALIDATE_INT) ?? 0;
$old_image_path = trim($_POST['old_image_path'] ?? '');

// Rich Text Content - DO NOT use htmlspecialchars or strip_tags here, 
// as we need to save the HTML markup. Use trim and prepared statements for security.
$content = trim($_POST['content'] ?? '');
$spefication = trim($_POST['spefication'] ?? '');

// 2. Basic Validation
/*
if (!$product_id || !$collectiongroups_id || empty($subheading) || empty($content) || empty($spefication)) {
    $_SESSION['error'] = "Required fields (ID, Group, Name, Content, Specification) are missing or invalid.";
    header("Location: products_edit.php?id=" . $product_id);
    exit;
}
*/

// 3. Image Upload and Path Handling
$new_image_file_name = null;
$upload_success = true;

// Define base upload directory
$base_upload_dir = '../uploads/group/';
// Determine the subdirectory based on the URL slug
$dir_name = strtolower(preg_replace('/[^a-z0-9]+/', '-', $url));
if (empty($dir_name)) {
    $dir_name = 'default';
}
$target_dir = $base_upload_dir . $dir_name . '/';

// Check if a new file was uploaded
if (isset($_FILES['image']) && $_FILES['image']['error'] == UPLOAD_ERR_OK) {
    
    $file_tmp = $_FILES['image']['tmp_name'];
    $file_name = basename($_FILES['image']['name']);
    $file_ext = strtolower(pathinfo($file_name, PATHINFO_EXTENSION));
    $new_image_file_name = time() . uniqid() . "." . $file_ext;
    $target_file = $target_dir . $new_image_file_name;

// Create the directory if it doesn't exist
    if (!is_dir($target_dir)) {
        mkdir($target_dir, 0777, true);
    }

// Attempt to move the new file
    if (move_uploaded_file($file_tmp, $target_file)) {
        
        // New image uploaded successfully. Delete the old one if it exists.
        if (!empty($old_image_path) && file_exists($old_image_path)) {
            unlink($old_image_path);
        }
    } else {
        $_SESSION['error'] = "Error uploading the new image file.";
        $upload_success = false;
    }
} else if (!empty($_FILES['image']['name']) && $_FILES['image']['error'] !== UPLOAD_ERR_NO_FILE) {
    // There was an error during upload (e.g., file too large)
    $_SESSION['error'] = "Image upload error: " . $_FILES['image']['error'];
    $upload_success = false;
}

// Exit if image upload failed
if (!$upload_success) {
    header("Location: products_edit.php?id=" . $product_id);
    exit;
}

// 4. Prepare and Execute SQL Update
$image_column_update = $new_image_file_name !== null ? ", image = ?" : "";
$sql = "UPDATE groups SET collectiongroups_id = ?, subheading = ?, url = ?, content = ?, spefication = ?, sort_order = ? "
     . $image_column_update
     . " WHERE id = ?";

$stmt = mysqli_prepare($conn, $sql);

if ($stmt) {
    $param_types = "issssi"; // i:int, s:string
    $params = [$collectiongroups_id, $subheading, $url, $content, $spefication, $sort_order];
    
    // Add new image file name to parameters if a new file was uploaded
    if ($new_image_file_name !== null) {
        $param_types .= "s";
        $params[] = $new_image_file_name;
    }
    
    // Add product ID as the last parameter
    $param_types .= "i";
    $params[] = $product_id;

// Use call_user_func_array to bind parameters (since the number/type is dynamic)
    $bind_params = array_merge([$param_types], $params);
    call_user_func_array('mysqli_stmt_bind_param', array_merge([$stmt], $bind_params));

if (mysqli_stmt_execute($stmt)) {
        $_SESSION['success'] = "Product updated successfully!";
    } else {
        $_SESSION['error'] = "Database error: Could not update product. " . mysqli_error($conn);
    }
    
    mysqli_stmt_close($stmt);
} else {
    $_SESSION['error'] = "Database error: Could not prepare update statement.";
}

// 5. Redirect back to the edit page or product list
header("Location: products_edit.php?id=" . $product_id);
exit;
?>