Zploit 0-Day Shell

:: Editing File: edit_projects.php

<?php
include '../../include/config.php';
include '../../auth.php';
include "../../include/header.php";
include "../../include/sidebar.php";
if (isset($_POST['submit']))
{
	//$properties_link = str_replace(" ", "",$_POST['porperties_name']);
	//echo $properties_link; die;

$dir_properties = $IMAGE_PATH."/storage/projects/";

//echo $dir; 
	//mkdir($IMAGE_PATH."storage/".$properties_link,0777,true);
	if (!file_exists($dir_properties)) {
	    mkdir($dir_properties, 0777, true);
	}
	//print_r($_FILES);
	//die;

/* porperties upload Image */
	$porperties_image = $_FILES['porperties_image']['name'];
	$porperties_image = str_replace(" ", "", $porperties_image);
	$porperties_image = trim($porperties_image);
	//die;

if(!empty($_FILES['porperties_image']['name']))
	{
		$admin_image_name=time().'-'.$porperties_image;
		$directory_name=$dir_properties;
		$porperties_image_name=$directory_name."/".$admin_image_name;
		
		if(move_uploaded_file($_FILES['porperties_image']['tmp_name'],$porperties_image_name)) 
		{
			echo "Portfolio image Upload";
			$porperties_image=$admin_image_name;
		}
		else
		{
			
			$porperties_image=$_POST['temp_porperties_image'];
			echo "Portfolio image Not Upload"	;
		}
	}
	else
	{
		$porperties_image=$_POST['temp_porperties_image'];	
	}

/* porperties upload Image *
	$porperties_animities_image = $_FILES['porperties_animities_image']['name'];
	$porperties_animities_image = str_replace(" ", "", $porperties_animities_image);
	$porperties_animities_image = trim($porperties_animities_image);
	//die;

if(!empty($_FILES['porperties_animities_image']['name']))
	{
		echo $admin_animities_name=time().'-'.$porperties_animities_image;
		die;

$directory_name=$dir_properties;
		$porperties_animities_name=$directory_name."/".$admin_animities_name;
		
		if(move_uploaded_file($_FILES['porperties_animities_image']['tmp_name'],$porperties_animities_name)) 
		{
			echo "porperties Animities image Upload";
			$porperties_animities_name=$admin_animities_name;
		}
		else
		{
			
			$porperties_animities_name=$_POST['temp_porperties_animities_image'];
			echo "porperties Animities image Not Upload"	;
		}
	}
	else
	{
		$porperties_animities_name=$_POST['temp_porperties_animities_image'];	
	}
	*/

if(!empty($porperties_image))
	{	
		$sql="update tbl_porjects SET
		category_id = '".$_POST['category_id']."',image = '".$porperties_image."',status='".$_POST['status']."'
		where id='".$_POST['id']."'";

//echo $sql; 
		$stmt=$conn->query($sql);

//echo "<pre>";
		//print_r($sql);
		//die;

//$stmt=$conn->query($sql);
		if($stmt)
		{
			$_SESSION["message"] = "Projects Update Successfully";
			echo '<script language="javascript" type="text/javascript"> 
				window.location = "list_projects.php";
				</script>';
		}
		else
		{
			$_SESSION["message"] = "Projects  Update Issue";
			echo '<script language="javascript" type="text/javascript"> 
			window.location = "list_projects.php";
			</script>';
		}
		
		$errMsg = "Projects Name Added Successfully";
	}
	else
	{
		$errMsg = "Projects Name not Added Successfully";
	}
}
?>
<?php 
$id = $_GET['id'];
$result ="SELECT * FROM tbl_porjects WHERE id='$id' ";
$stmt1=$conn->query($result); 
$res = $stmt1->fetch(PDO::FETCH_ASSOC);
//echo "<pre>";print_r($res); die;
//$category_id=$res['category_id'];
?>

<div class="col-sm-6">
										<div class="form-group">
											<label>Category Name*</label>
												<?php /*
												$sql1="SELECT * FROM tbl_category";
												$stmt1=$conn->query($sql1);
												echo '<select name="category_id" class="form-control" required>'; 
												echo '<option value=""> -- Select --- </option>';
												while ($row = $stmt1->fetch(PDO::FETCH_ASSOC)) {
												   echo '<option value="'.$row['id'].'">'.$row['name'].'</option>';
													}
												echo '</select>'; */?>

<?php
													$sql1="SELECT * FROM tbl_category";
													$stmt_menu=$conn->query($sql1);
													echo '<select name="category_id" class="form-control" required>';
													while($row_menu = $stmt_menu->fetch(PDO::FETCH_ASSOC))
													{
														if($res['category_id']  == $row_menu['id'])
														{
														echo "<option selected='selected' value='" . $row_menu['id'] . "'>" . $row_menu['name'] . "</option>";
														}
														else
														echo "<option value='" . $row_menu['id'] . "'>" . $row_menu['name'] . "</option>";
													}
													echo "</select>";
												?>
										</div>      
									</div>
									
									<div class="col-sm-3">
										<div class="form-group">
											<label>Porperties Image</label>
											<input type="file" class="form-control" name="porperties_image" style="padding: 0.375rem 0.5rem;"/>
										</div>
									</div>
									<div class="col-sm-3">
										<?php if(!empty($res['image']))
											{ ?>

<img src="<?php echo $DOMAIN_NAME_ADMIN.'/storage/projects/'.$res['image']?>"  class="form-control" name=""	 style="width:80px;height:80px">
											<?php } else { ?>
												<img src="<?php echo $DOMAIN_NAME_ADMIN.'/storage/gallery.jpg'?>" width="100px" height="100px" style="float:right">
											<?php } ?>
									</div>
									
									
									<div class="col-sm-6">
										<div class="form-group">
											<label>Website Link</label>
											<input type="text" class="form-control" name="web_link" value="<?php $res['web_link'] ?>" />
										</div>
									</div>
									
									<div class="col-sm-6">
										<div class="form-group">
											<label>Status</label>
											<select name="status" class="form-control"> 
												<option <?php if($res['status']=='1') echo "selected"; ?> value='1'>Active </option>
												<option <?php if($res['status']=='0') echo "selected"; ?> value='0'>In Active</option>
											</select>
										</div>
									</div>

</div>

</div> 
								<center><br><input type="submit" name="submit" class="btn btn-primary text-center" style="font-size: 20px;">
								<a  href="list_properties.php"  class="btn btn-danger" style="font-size: 20px;">Back</a></center><br><br>
							</div>
							
						</form>
					</div>
				</div>
			</div>
		</section>
    
	</div>
  
<?php include "../../include/footer.php"; ?>
  <script src="https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.6-rc.0/js/select2.min.js"></script>
    <script>
      $("#single").select2({
          placeholder: "Select a programming language",
          allowClear: true
      });
	</script>
	
	
	<script src="<?php echo $DOMAIN_NAME_ADMIN;?>assets/vendor_plugins/bootstrap-wysihtml5/bootstrap3-wysihtml5.all.js"></script>
	
	<script src="<?php echo $DOMAIN_NAME_ADMIN;?>assets/vendor_components/ckeditor/ckeditor.js"></script>

<script src="<?php echo $DOMAIN_NAME_ADMIN;?>assets/vendor_plugins/bootstrap-wysihtml5/bootstrap3-wysihtml5.all.js"></script>
	
	<script src="<?php echo $DOMAIN_NAME_ADMIN;?>assets/vendor_components/ckeditor/ckeditor.js"></script>
	
	<script src="<?php echo $DOMAIN_NAME_ADMIN;?>js/pages/editor.js"></script>