Zploit 0-Day Shell

:: Editing File: delete_account.php

<?php
ob_start(); // Start output buffering
header('Content-Type: text/plain');
include('db.php');

if (!isset($_POST['user_id']) || !isset($_POST['password'])) {
    ob_end_clean();
    echo "Missing required parameters";
    exit;
}

$user_id = mysqli_real_escape_string($conn, $_POST['user_id']);
$password = trim($_POST['password']);
$delete_reason = isset($_POST['delete_reason']) ? mysqli_real_escape_string($conn, trim($_POST['delete_reason'])) : '';

// Validate inputs
if (empty($password)) {
    ob_end_clean();
    echo "Password is required";
    exit;
}

// Verify password
$sql_check = "SELECT password, sv_user_id FROM user_details WHERE user_id = '$user_id'";
$result_check = mysqli_query($conn, $sql_check);

if (!$result_check) {
    ob_end_clean();
    echo "Database error: " . mysqli_error($conn);
    exit;
}

if (mysqli_num_rows($result_check) == 0) {
    ob_end_clean();
    echo "User not found";
    exit;
}

$row = mysqli_fetch_assoc($result_check);
$stored_password = $row['password'];
$sv_user_id = $row['sv_user_id'];

// Verify password matches
if ($stored_password != $password) {
    ob_end_clean();
    echo "Password is incorrect. Please enter the correct password.";
    exit;
}

// Check if delete request already exists
$sql_check_request = "SELECT * FROM account_delete_request WHERE user_id = '$user_id' AND status = 'Pending'";
$result_check_request = mysqli_query($conn, $sql_check_request);

if ($result_check_request && mysqli_num_rows($result_check_request) > 0) {
    ob_end_clean();
    echo "A deletion request is already pending. We will contact you soon.";
    exit;
}

// Check if account_delete_request table exists, create if not
$table_check = mysqli_query($conn, "SHOW TABLES LIKE 'account_delete_request'");
if (!$table_check || mysqli_num_rows($table_check) == 0) {
    $sql_create_table = "CREATE TABLE IF NOT EXISTS `account_delete_request` (
      `id` int(11) NOT NULL AUTO_INCREMENT,
      `user_id` int(11) NOT NULL,
      `riv_user_id` varchar(255) DEFAULT NULL,
      `sv_user_id` varchar(255) DEFAULT NULL,
      `delete_request_description` text,
      `status` varchar(50) DEFAULT 'Pending',
      `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
      `updated_at` timestamp NULL DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
      PRIMARY KEY (`id`),
      KEY `user_id` (`user_id`),
      KEY `status` (`status`)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci";
    
    if (!mysqli_query($conn, $sql_create_table)) {
        ob_end_clean();
        echo "Failed to create delete request table: " . mysqli_error($conn);
        exit;
    }
}

// Insert delete request
$sql_insert = "INSERT INTO account_delete_request (user_id, sv_user_id, delete_request_description, status) 
               VALUES ('$user_id', '$sv_user_id', '$delete_reason', 'Pending')";

if (mysqli_query($conn, $sql_insert)) {
    ob_end_clean();
    echo "1";
} else {
    ob_end_clean();
    echo "Failed to submit deletion request: " . mysqli_error($conn);
}

mysqli_close($conn);
?>