Zploit 0-Day Shell

:: Editing File: hosting_details_edit.php

<?php
ob_start();
include 'header.php';
$page_title = "Edit Client Hosting";
$page_parent = "Clients Hosting";
$page_parent_link = "hosting_details_list.php";

include 'breadcrumb.php';
include 'menu.php';

if (!isset($_GET['id'])) {
    header("Location: hosting_details_list.php");
    exit;
}
$id = $_GET['id'];
$sql = mysqli_query($conn, "SELECT * FROM hosting_details WHERE id='$id'");
$data = mysqli_fetch_assoc($sql);

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $client_id = $_POST['client_id'];
    $start_date = $_POST['start_date'];
    $expiry_date = $_POST['expiry_date'];
    $amount = $_POST['amount'];
    $notes = $_POST['notes'];
    $comments = $_POST['comments'];

$update = "UPDATE hosting_details SET 
        client_id='$client_id',
        start_date='$start_date',
        expiry_date='$expiry_date',
        amount='$amount',
        notes='$notes',
        comments='$comments'
        WHERE id='$id'";

if (mysqli_query($conn, $update)) {
        header("Location: hosting_details_list.php?msg=Updated Successfully");
        exit;
    }
}
?>

<div class="page-body">
  <div class="container-fluid">
    <div class="card">
      <div class="card-header"><h2>Edit Hosting Details</h2></div>
      <div class="card-body">

<div class="col-md-6">
              <label>Client</label>
              <select name="client_id" class="form-select" required>
                <?php
                $clients = mysqli_query($conn, "SELECT * FROM clients");
                while ($c = mysqli_fetch_assoc($clients)) {
                    $selected = ($c['id'] == $data['client_id']) ? "selected" : "";
                    echo "<option value='{$c['id']}' $selected>{$c['name']}</option>";
                }
                ?>
              </select>
            </div>

<div class="col-md-6"><label>Start Date</label><input type="date" name="start_date" class="form-control" value="<?= $data['start_date']; ?>"></div>
            <div class="col-md-6"><label>Expiry Date</label><input type="date" name="expiry_date" class="form-control" value="<?= $data['expiry_date']; ?>"></div>
            <div class="col-md-6"><label>Amount (₹)</label><input type="number" step="0.01" name="amount" class="form-control" value="<?= $data['amount']; ?>"></div>
            <div class="col-md-6"><label>Details</label><textarea name="notes" class="form-control"><?= $data['notes']; ?></textarea></div>
            <div class="col-md-6"><label>Comments</label><textarea name="comments" class="form-control"><?= $data['comments']; ?></textarea></div>

</div>

<div class="mt-4">
            <button class="btn btn-success">Update</button>
            <a href="hosting_details_list.php" class="btn btn-secondary">Cancel</a>
          </div>
        </form>
      </div>
    </div>
  </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>