Zploit 0-Day Shell

:: Editing File: expenses_edit.php

<?php 
ob_start();
include 'header.php';

$page_title = "Edit Expense";
$page_parent = "Expenses";
$page_parent_link = "expenses_list.php";

include 'breadcrumb.php';
include 'menu.php';

$id = $_GET['id'];
$message = "";

$q = mysqli_query($conn, "SELECT * FROM expenses WHERE id='$id'");
$data = mysqli_fetch_assoc($q);

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  $team_id = $_POST['team_id'];
  $date = $_POST['expenses_date'];
  $salary = $_POST['salary_amount'];
  $advance = $_POST['advance_taken'];
  $msg = $_POST['message'];
  $service = $_POST['services_expenses'];
  $service_amt = $_POST['services_amount'];
  $other = $_POST['other_cost'];
  $sundry = $_POST['sundry_expenses'];
  $notes = $_POST['notes'];
  $comments = $_POST['comments'];

$sql = "UPDATE expenses SET 
          team_id='$team_id', expenses_date='$date', salary_amount='$salary', advance_taken='$advance',
          message='$msg', services_expenses='$service', services_amount='$service_amt',
          other_cost='$other', sundry_expenses='$sundry', notes='$notes', comments='$comments'
          WHERE id='$id'";

if (mysqli_query($conn, $sql)) {
    header("Location: expenses_list.php?msg=Expense Updated Successfully");
    exit;
  } else {
    $message = "Error: " . mysqli_error($conn);
  }
}
?>

<div class="page-body">
  <div class="container-fluid">
    <div class="card">
      <div class="card-header"><h2>Edit Expense</h2></div>
      <div class="card-body">
        <?php if ($message) echo "<div class='alert alert-danger'>$message</div>"; ?>

<div class="col-md-6">
              <label>Team Member</label>
              <select name="team_id" class="form-select">
                <?php 
                $res = mysqli_query($conn, "SELECT * FROM team_members");
                while ($tm = mysqli_fetch_assoc($res)) {
                  $sel = ($tm['id'] == $data['team_id']) ? "selected" : "";
                  echo "<option value='{$tm['id']}' $sel>{$tm['name']}</option>";
                }
                ?>
              </select>
            </div>

<div class="col-md-4">
              <label>Salary Amount</label>
              <input type="number" name="salary_amount" class="form-control" value="<?= $data['salary_amount'] ?>">
            </div>

<div class="col-md-4">
              <label>Advance Taken</label>
              <input type="number" name="advance_taken" class="form-control" value="<?= $data['advance_taken'] ?>">
            </div>

<div class="col-md-4">
              <label>Service Expenses</label>
              <input type="text" name="services_expenses" class="form-control" value="<?= $data['services_expenses'] ?>">
            </div>

<div class="col-md-4">
              <label>Service Amount</label>
              <input type="number" name="services_amount" class="form-control" value="<?= $data['services_amount'] ?>">
            </div>

<div class="col-md-4">
              <label>Other Cost</label>
              <input type="number" name="other_cost" class="form-control" value="<?= $data['other_cost'] ?>">
            </div>

<div class="col-md-4">
              <label>Sundry Expenses</label>
              <input type="number" name="sundry_expenses" class="form-control" value="<?= $data['sundry_expenses'] ?>">
            </div>

<div class="col-md-6">
              <label>Message</label>
              <textarea name="message" class="form-control"><?= $data['message'] ?></textarea>
            </div>

<div class="col-md-6">
              <label>Notes</label>
              <textarea name="notes" class="form-control"><?= $data['notes'] ?></textarea>
            </div>

<div class="col-md-6">
              <label>Comments</label>
              <textarea name="comments" class="form-control"><?= $data['comments'] ?></textarea>
            </div>

</div>

<div class="mt-3">
            <button type="submit" class="btn btn-success">Update</button>
            <a href="expenses_list.php" class="btn btn-secondary">Cancel</a>
          </div>

</form>
      </div>
    </div>
  </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>