Zploit 0-Day Shell

:: Editing File: upload_biodata.php

<?php
header('Content-Type: text/plain');
ob_start();
include('db.php');
require_once __DIR__ . '/../../shared/soulmeet_global.php';

if (!isset($_POST['user_id'])) {
  ob_end_clean();
  echo "Missing user_id parameter";
  exit;
}

if (!isset($_FILES['biodata_pdf']) || $_FILES['biodata_pdf']['error'] !== UPLOAD_ERR_OK) {
  ob_end_clean();
  echo "No biodata uploaded";
  exit;
}

$user_id = mysqli_real_escape_string($conn, $_POST['user_id']);
$file = $_FILES['biodata_pdf'];
$file_name = $file['name'] ?? '';
$ext = strtolower(pathinfo($file_name, PATHINFO_EXTENSION));

if ($ext !== 'pdf') {
  ob_end_clean();
  echo "Invalid file type. Only PDF allowed.";
  exit;
}

soulmeetEnsureBiodataTable($conn);

$upload_dir = SOULMEET_ADMIN_IMAGES_DOCUMENTS_DIR;
soulmeetMkdir($upload_dir);

// If existing biodata exists, delete it first (keep 1 latest per user)
$resOld = mysqli_query($conn, "SELECT id, biodata_file FROM biodata_documents WHERE user_id = '$user_id' ORDER BY id DESC LIMIT 1");
if ($resOld && mysqli_num_rows($resOld) > 0) {
  $old = mysqli_fetch_assoc($resOld);
  $oldFile = (string)($old['biodata_file'] ?? '');
  if ($oldFile !== '') {
    $oldPath = $upload_dir . $oldFile;
    if (file_exists($oldPath)) {
      @unlink($oldPath);
    }
  }
  $oldId = (int)($old['id'] ?? 0);
  if ($oldId > 0) {
    mysqli_query($conn, "DELETE FROM biodata_documents WHERE id = $oldId");
  }
}

$unique = uniqid();
$new_file = $user_id . '_BIO_' . $unique . '.pdf';
$dest = $upload_dir . $new_file;

if (!move_uploaded_file($file['tmp_name'], $dest)) {
  ob_end_clean();
  echo "Failed to upload file";
  exit;
}

$new_file_esc = mysqli_real_escape_string($conn, $new_file);
if (mysqli_query($conn, "INSERT INTO biodata_documents (user_id, biodata_file) VALUES ('$user_id', '$new_file_esc')")) {
  ob_end_clean();
  echo "Biodata uploaded successfully!";
  exit;
}

// rollback file on DB error
if (file_exists($dest)) {
  @unlink($dest);
}
ob_end_clean();
echo "Database error: " . mysqli_error($conn);
?>