Zploit 0-Day Shell

:: Editing File: vcard_about_edit.php

<?php
ob_start();
include 'header.php';

$page_title = "Edit VCard About";
$page_parent = "VCards";
$page_parent_link = "vcard_about_list.php";

include 'breadcrumb.php';
include 'menu.php';

/* ===============================
   PATH CONFIG
   =============================== */
define('VCARD_UPLOAD_PATH', $_SERVER['DOCUMENT_ROOT'].'/kreativecrm/uploads/vcard/');

/* ===============================
   VALIDATE ID
   =============================== */
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    header("Location: vcard_about_list.php?msg=Invalid Service ID");
    exit;
}

$id = intval($_GET['id']);

/* ===============================
   FETCH SERVICE
   =============================== */
$q = mysqli_query($conn,"SELECT * FROM vcard_about WHERE id='$id'");
if (!$q || mysqli_num_rows($q) === 0) {
    header("Location: vcard_about_list.php?msg=Service Not Found");
    exit;
}
$row = mysqli_fetch_assoc($q);

/* ===============================
   FETCH CURRENT VCARD SLUG
   =============================== */
$v = mysqli_query($conn,"SELECT card_slug FROM vcards WHERE id='{$row['vcard_id']}'");
$vcard = mysqli_fetch_assoc($v);

$slug = $vcard['card_slug'];
$upload_dir = VCARD_UPLOAD_PATH.$slug.'/services/';

if (!is_dir($upload_dir)) {
    mkdir($upload_dir, 0777, true);
}

/* ===============================
   FORM SUBMIT
   =============================== */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$vcard_id   = intval($_POST['vcard_id']);
    $title      = mysqli_real_escape_string($conn, $_POST['title']);
    $description= mysqli_real_escape_string($conn, $_POST['description']);
    $sort_order = intval($_POST['sort_order']);
    $status     = isset($_POST['status']) ? 1 : 0;

/* ===============================
       FETCH NEW SLUG (IF VCARD CHANGED)
       =============================== */
    if ($vcard_id != $row['vcard_id']) {
        $v = mysqli_query($conn,"SELECT card_slug FROM vcards WHERE id='$vcard_id'");
        $vc = mysqli_fetch_assoc($v);
        if ($vc) {
            $slug = $vc['card_slug'];
            $upload_dir = VCARD_UPLOAD_PATH.$slug.'/services/';
            if (!is_dir($upload_dir)) {
                mkdir($upload_dir, 0777, true);
            }
        }
    }

/* ===============================
       img UPLOAD
       =============================== */
    $img = $row['img'];

if (!empty($_FILES['img']['name'])) {

// delete old img
        if ($img && file_exists($upload_dir.$img)) {
            unlink($upload_dir.$img);
        }

$ext = strtolower(pathinfo($_FILES['img']['name'], PATHINFO_EXTENSION));
        $img = time().'_service.'.$ext;

move_uploaded_file(
            $_FILES['img']['tmp_name'],
            $upload_dir.$img
        );
    }

/* ===============================
       UPDATE DATABASE
       =============================== */
    mysqli_query($conn,"
        UPDATE vcard_about SET
            vcard_id   = '$vcard_id',
            title      = '$title',
            description= '$description',
            img       = ".($img ? "'$img'" : "NULL").",
            sort_order = '$sort_order',
            status     = '$status',
            updated_at = NOW()
        WHERE id='$id'
    ");

header("Location: vcard_about_list.php?msg=Service Updated Successfully");
    exit;
}
?>

<div class="page-body">
<div class="container-fluid">
<div class="row">
<div class="col-sm-12">

<div class="card">
<div class="card-header pb-0 card-no-border">
    <h2>Edit VCard About</h2>
</div>

<div class="col-md-6 mb-3">
<label class="form-label">Select VCard *</label>
<select name="vcard_id" class="form-control" required>
<?php
$vcards = mysqli_query($conn,"SELECT id, full_name FROM vcards WHERE status=1 ORDER BY full_name");
while ($v = mysqli_fetch_assoc($vcards)) {
    $sel = ($v['id'] == $row['vcard_id']) ? 'selected' : '';
    echo "<option value='{$v['id']}' $sel>".htmlspecialchars($v['full_name'])."</option>";
}
?>
</select>
</div>

<div class="col-md-6 mb-3">
<label class="form-label">Service Title *</label>
<input type="text" name="title" class="form-control"
       value="<?= htmlspecialchars($row['title']); ?>" required>
</div>

<div class="col-md-12 mb-3">
<label class="form-label">Description</label>
<textarea name="description" class="form-control" rows="4"><?= htmlspecialchars($row['description']); ?></textarea>
</div>

<div class="col-md-6 mb-3">
<label class="form-label">About Image</label>
<input type="file" name="img" class="form-control">
<?php if ($row['img']): ?>
    <div class="mt-2">
        <img src="uploads/vcard/<?= $slug; ?>/services/<?= $row['img']; ?>"
             style="height:50px;border-radius:6px;">
    </div>
<?php endif; ?>
</div>

<div class="col-md-3 mb-3">
<label class="form-label">Sort Order</label>
<input type="number" name="sort_order" class="form-control"
       value="<?= (int)$row['sort_order']; ?>">
</div>

<div class="col-md-3 mb-3">
<label class="form-label">Status</label><br>
<input type="checkbox" name="status" <?= ($row['status']==1)?'checked':''; ?>> Active
</div>

</div>

<br>
<button type="submit" class="btn btn-success">Update Service</button>
<a href="vcard_about_list.php" class="btn btn-secondary">Cancel</a>

</form>

</div>
</div>

</div>
</div>
</div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>