Zploit 0-Day Shell

:: Editing File: save_profile.php

<?php
session_start();
include('db.php');
header('Content-Type: application/json');

$user_id = isset($_SESSION['user_id']) ? intval($_SESSION['user_id']) : 0;
$profile_id = isset($_POST['profile_id']) ? intval($_POST['profile_id']) : 0;
$action = isset($_POST['action']) ? $_POST['action'] : 'save'; // 'save' or 'unsave'

if ($user_id <= 0) {
    echo json_encode(['status' => 'error', 'message' => 'User not logged in']);
    exit;
}

if ($profile_id <= 0) {
    echo json_encode(['status' => 'error', 'message' => 'Invalid profile ID']);
    exit;
}

if ($user_id == $profile_id) {
    echo json_encode(['status' => 'error', 'message' => 'Cannot save your own profile']);
    exit;
}

// Ensure the table exists
$table_check = mysqli_query($conn, "SHOW TABLES LIKE 'saved_profiles'");
if (!$table_check || mysqli_num_rows($table_check) == 0) {
    $create_table_sql = "CREATE TABLE IF NOT EXISTS `saved_profiles` (
        `id` int(11) NOT NULL AUTO_INCREMENT,
        `user_id` int(11) NOT NULL COMMENT 'User who saved the profile',
        `saved_profile_id` int(11) NOT NULL COMMENT 'Profile that was saved',
        `saved_at` datetime DEFAULT CURRENT_TIMESTAMP COMMENT 'When the profile was saved',
        PRIMARY KEY (`id`),
        UNIQUE KEY `unique_save` (`user_id`, `saved_profile_id`),
        KEY `user_id` (`user_id`),
        KEY `saved_profile_id` (`saved_profile_id`),
        KEY `saved_at` (`saved_at`)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='Tracks profiles saved/favourited by users'";
    mysqli_query($conn, $create_table_sql);
}

if ($action === 'unsave') {
    // Remove from saved
    $delete_sql = "DELETE FROM saved_profiles WHERE user_id = '$user_id' AND saved_profile_id = '$profile_id'";
    if (mysqli_query($conn, $delete_sql)) {
        echo json_encode(['status' => 'success', 'message' => 'Profile removed from saved', 'saved' => false]);
    } else {
        echo json_encode(['status' => 'error', 'message' => 'Failed to remove: ' . mysqli_error($conn)]);
    }
} else {
    // Save the profile
    $insert_sql = "INSERT INTO saved_profiles (user_id, saved_profile_id, saved_at) 
                  VALUES ('$user_id', '$profile_id', NOW())
                  ON DUPLICATE KEY UPDATE saved_at = NOW()";
    if (mysqli_query($conn, $insert_sql)) {
        echo json_encode(['status' => 'success', 'message' => 'Profile saved successfully', 'saved' => true]);
    } else {
        echo json_encode(['status' => 'error', 'message' => 'Failed to save: ' . mysqli_error($conn)]);
    }
}
?>