Zploit 0-Day Shell

:: Editing File: invoice_update_old.php

<?php

ob_start();
include 'header.php';
require_once('tcpdf_min/tcpdf.php');

// Check POST
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

// Basic invoice info
   /* $invoice_id   = intval($_POST['invoice_id']);*/
   $payment_id   = mysqli_real_escape_string($conn, $_POST['payment_id']);
   $client_id   = mysqli_real_escape_string($conn, $_POST['client_id']);
    $invoice_no   = mysqli_real_escape_string($conn, $_POST['invoice_no']);
     $payment_mode = mysqli_real_escape_string($conn, $_POST['payment_mode']);
    $invoice_date = mysqli_real_escape_string($conn, $_POST['invoice_date']);
   
    $payment_mode = mysqli_real_escape_string($conn, $_POST['payment_mode']);
   /* $terms        = mysqli_real_escape_string($conn, $_POST['terms']);*/
   $terms  = '1'; 
    $sub_total    = floatval($_POST['sub_total']);
    $tax_total    = floatval($_POST['tax_total']);
    $grand_total  = floatval($_POST['grand_total']);

// Fetch client ID
 //   $client_id = intval($_POST['client_id']);

// Get or create invoice
$invoice_no   = mysqli_real_escape_string($conn, $_POST['invoice_no']);
$invoice_date = mysqli_real_escape_string($conn, $_POST['invoice_date']);
$payment_mode = mysqli_real_escape_string($conn, $_POST['payment_mode']);
$sub_total    = floatval($_POST['sub_total']);
$tax_total    = floatval($_POST['tax_total']);
$grand_total  = floatval($_POST['grand_total']);
$client_id    = intval($_POST['client_id']);

// ✅ 1. Check if this invoice number already exists
$check = mysqli_query($conn, "SELECT id FROM invoices WHERE invoice_no = '$invoice_no' LIMIT 1");

if (mysqli_num_rows($check) > 0) {
    // -----------------------
    // ✅ UPDATE existing invoice
    // -----------------------
    $sql = "UPDATE invoices SET 
                payment_id = '$payment_id',
                invoice_date = '$invoice_date',
                payment_mode = '$payment_mode',
                sub_total = '$sub_total',
                tax_total = '$tax_total',
                grand_total = '$grand_total',
                updated_at = NOW()
            WHERE invoice_no = '$invoice_no'";

mysqli_query($conn, $sql);
    $invoice_id = mysqli_fetch_assoc($check)['id'];

} else {
    // -----------------------
    // 🆕 INSERT new invoice (with next invoice number)
    // -----------------------

// Get last invoice number (auto increment)
    $res = mysqli_query($conn, "SELECT invoice_no FROM invoices ORDER BY id DESC LIMIT 1");

$sql = "INSERT INTO invoices (payment_id, invoice_no, client_id, invoice_date, payment_mode, sub_total, tax_total, grand_total, created_at)
            VALUES ('$payment_id', '$invoice_no', '$client_id', '$invoice_date', '$payment_mode', '$sub_total', '$tax_total', '$grand_total', NOW())";

mysqli_query($conn, $sql);
    $invoice_id = mysqli_insert_id($conn);
}

// ✅ Delete old items
    //mysqli_query($conn, "DELETE FROM invoice_items WHERE invoice_id = '$invoice_id'");

// ✅ Reinsert updated items
    foreach ($_POST['description'] as $i => $desc) {
        $hsn      = mysqli_real_escape_string($conn, $_POST['hsn_code'][$i]);
        $price    = floatval($_POST['price'][$i]);
        $qty      = floatval($_POST['quantity'][$i]);
        $tax      = floatval($_POST['tax_percent'][$i]);
        $taxable  = floatval($_POST['taxable_amount'][$i]);

$item_sql = "INSERT INTO invoice_items (payment_id, invoice_id, description, hsn_code, price, quantity, tax_percent, taxable_amount)
                     VALUES ('$payment_id', '$invoice_no', '$desc', '$hsn', '$price', '$qty', '$tax', '$taxable')";
        mysqli_query($conn, $item_sql);
    }

// ✅ Optional: Regenerate PDF
    $generate_pdf = true; // change to false if you don’t want auto PDF update
    if ($generate_pdf) {

$client = mysqli_fetch_assoc(mysqli_query($conn, "SELECT * FROM clients WHERE name = '$client_id'"));
        $items  = mysqli_query($conn, "SELECT * FROM invoice_items WHERE invoice_id = '$invoice_no'");

$pdf = new TCPDF();
        $pdf->AddPage();
        $pdf->SetFont('helvetica', 'B', 16);
        $pdf->Cell(0, 10, 'Tax Invoice', 0, 1, 'C');
        $pdf->Ln(5);

// Bill To
        $pdf->SetFont('helvetica', '', 10);
        $pdf->MultiCell(100, 5, "Bill To:\n" . $client['name'] . "\n" . $client['address'], 0, 'L');
        $pdf->Ln(5);

// Items Table
        $html = '<table border="1" cellpadding="4">
                  <thead>
                    <tr style="background-color:#f2f2f2;">
                      <th>Description</th>
                      <th>HSN</th>
                      <th>Qty</th>
                      <th>Price</th>
                      <th>Tax%</th>
                      <th>Total</th>
                    </tr>
                  </thead><tbody>';

while ($row = mysqli_fetch_assoc($items)) {
            $html .= "<tr>
                <td>{$row['description']}</td>
                <td>{$row['hsn_code']}</td>
                <td>{$row['quantity']}</td>
                <td>{$row['price']}</td>
                <td>{$row['tax_percent']}</td>
                <td>{$row['taxable_amount']}</td>
              </tr>";
        }
        $html .= '</tbody></table>';
        $pdf->writeHTML($html, true, false, false, false, '');

// Totals
        $pdf->Ln(10);
        $pdf->SetFont('helvetica', 'B', 12);
        $pdf->Cell(0, 10, 'Grand Total: ₹' . number_format($grand_total, 2), 0, 1, 'R');

// Barcode
        $pdf->write1DBarcode($invoice_no, 'C128', '', '', '', 18, 0.4, [], 'N');

// Save PDF
        /*$folder = 'uploads/system_invoices/';
        if (!file_exists($folder)) mkdir($folder, 0777, true);
        $filePath = $folder . $invoice_no . '.pdf';
        $pdf->Output($filePath, 'F');
        */
        
        
        // ...
        // Save PDF
        $folder = 'uploads/system_invoices/';
        if (!file_exists($folder)) mkdir($folder, 0777, true);
        
        // 🆕 Use realpath/__DIR__ to ensure the path is absolute
        $base_dir = realpath(__DIR__ . '/') . '/'; // Adjust path if 'invoices/' is not next to this script
        
        $file = $folder . $invoice_no . '.pdf'; 
        // Assuming 'invoices/' is in the same directory as the script. If not, adjust.
        $filePath = $base_dir . $folder . $invoice_no . '.pdf'; 
        
        $pdf->Output($filePath, 'F');
        
        
        mysqli_query($conn, "UPDATE payment_details SET invoice_pdf='$file' WHERE id='$payment_id'");
        mysqli_query($conn, "UPDATE invoices SET pdf_path='$filePath' WHERE id='$invoice_id'");
    }

// ✅ Redirect back
    header("Location: payment_details_list.php?client_id=$client_id&payment_id=$payment_id&msg=Invoice updated successfully");
    exit;
}
?>
<?php ob_end_flush(); ?>