Zploit 0-Day Shell

:: Editing File: q_all_update.php

<?php
include 'config/db.php';

function create_slug($string) {
    $slug = strtolower($string); // Convert to lower case
    $slug = preg_replace('/[^a-z0-9\s-]/', '', $slug); // Remove special characters
    $slug = preg_replace('/[\s-]+/', ' ', $slug); // Clean up multiple spaces/dashes
    $slug = preg_replace('/[\s]/', '-', $slug); // Convert spaces to dashes
    return $slug;
}

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $q_id = $_POST['quotation_id'];
    $client_name = $_POST['client_name'];
    $site_dim = $_POST['site_dimension'];
	
	// Create Slug
    $client_slug = create_slug($client_name);
	
	// Handle Image Upload
    $pic_path = ""; 
    if (!empty($_FILES['pic']['name'])) {
        $dir = "uploads/quotations_all/" . $client_slug . "/";
        
        // Create folder if it doesn't exist
        if (!is_dir($dir)) {
            mkdir($dir, 0777, true);
        }
        
        $file_name = time() . "_" . basename($_FILES['pic']['name']);
        $target_file = $dir . $file_name;
        
        if (move_uploaded_file($_FILES['pic']['tmp_name'], $target_file)) {
            $pic_path = $target_file;
        }
    }
	
	$q_res = $conn->query("SELECT * FROM quotations WHERE id = $q_id");
    $q_data = $q_res->fetch_assoc();
	
	if(empty($q_data))
	{
		$sql = "INSERT INTO quotations (client_name, client_slug, site_dimension, pic) 
        VALUES ('$client_name', '$client_slug', '$site_dim', '$pic_path')";
		
		if ($conn->query($sql)) {
			// 3. Capture the NEW ID created by the database
			$q_id = $conn->insert_id; 
			
			// Now you can use this $q_id to insert into quotation_scope, estimation, etc.
		} else {
			die("Insert Error: " . $conn->error);
		}

//echo "11";
		
	}else
	{
		$sql = "UPDATE quotations SET 
        client_name = '$client_name', 
        client_slug = '$client_slug', 
        site_dimension = '$site_dim'";

if (!empty($pic_path)) {
			$sql .= ", pic = '$pic_path'";
		}

$sql .= " WHERE id = $q_id";

// Add error reporting to see if it fails
		if (!$conn->query($sql)) {
			die("SQL Error: " . $conn->error);
		}
		
		echo "2";
	}

/*
// 1. Update Client Info

// CORRECTED CODE
$sql = "UPDATE quotations SET 
        client_name = '$client_name', 
        client_slug = '$client_slug', 
        site_dimension = '$site_dim'";

if (!empty($pic_path)) {
    $sql .= ", pic = '$pic_path'";
}

$sql .= " WHERE id = $q_id";

// Add error reporting to see if it fails
if (!$conn->query($sql)) {
    die("SQL Error: " . $conn->error);
}
*/

// 2. Process Scope (Delete old and Insert new)
    $conn->query("DELETE FROM quotation_scope WHERE quotation_id = $q_id");
    foreach ($_POST['scope_desc'] as $cat => $descriptions) {
        foreach ($descriptions as $index => $desc) {
            $spec = $_POST['scope_spec'][$cat][$index];
            if(!empty($desc)){
                $sort = $index + 1;
                $conn->query("INSERT INTO quotation_scope (quotation_id, category, work_description, specification, sort_order) 
                              VALUES ($q_id, '$cat', '$desc', '$spec', $sort)");
            }
        }
    }

// 3. Process Extra Works
    $conn->query("DELETE FROM quotation_extra_works WHERE quotation_id = $q_id");
    foreach ($_POST['extra_work'] as $index => $extra) {
        if(!empty($extra)){
            $sort = $index + 1;
            $conn->query("INSERT INTO quotation_extra_works (quotation_id, extra_work, sort_order) 
                          VALUES ($q_id, '$extra', $sort)");
        }
    }

// 4. Process Terms
    $conn->query("DELETE FROM quotation_terms WHERE quotation_id = $q_id");
    foreach ($_POST['terms'] as $index => $term) {
        if(!empty($term)){
            $sort = $index + 1;
            $conn->query("INSERT INTO quotation_terms (quotation_id, term, sort_order) 
                          VALUES ($q_id, '$term', $sort)");
        }
    }
	
	
	// 5. Process Estimation Table
	// First, clear old records for this quotation
	$conn->query("DELETE FROM quotation_estimation WHERE quotation_id = $q_id");

if (isset($_POST['est_desc'])) {
		foreach ($_POST['est_desc'] as $index => $desc) {
			$area = $conn->real_escape_string($_POST['est_area'][$index]);
			$amount = (float)$_POST['est_amount'][$index];
			
			if(!empty($desc)) {
				$stmt = $conn->prepare("INSERT INTO quotation_estimation (quotation_id, description, area_sqft, amount) VALUES (?, ?, ?, ?)");
				$stmt->bind_param("issd", $q_id, $desc, $area, $amount);
				$stmt->execute();
			}
		}
	}

header("Location: qcompany_list.php?id=$q_id&status=success");
}
?>