Zploit 0-Day Shell

:: Editing File: payment_details_edit.php

<?php
ob_start();
$page_title = "Edit Clients Payment Details";
$page_parent = "Clients Payments";
$page_parent_link = "payment_details_list.php";

include 'header.php';
include 'breadcrumb.php';
include 'menu.php';

$id = $_GET['id'];
$row = mysqli_fetch_assoc(mysqli_query($conn, "SELECT * FROM payment_details WHERE id='$id'"));

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $clients_id = $_POST['clients_id'];
    $payment = $_POST['payment'];
    $payment_received = $_POST['payment_received'];
    $payment_received_date = $_POST['payment_received_date'];
    $payment_remaining = $_POST['payment_remaining'];
    $notes = $_POST['notes'];
    $comments = $_POST['comments'];
    $service_taken = isset($_POST['service_taken']) ? implode(',', $_POST['service_taken']) : '';
    $amount_details = $_POST['amount_details'];
    $invoice_number = $_POST['invoice_number'];

// Handle invoice image upload (optional)
    $invoice_img = $row['invoice_img'];
    if (!empty($_FILES['invoice_img']['name'])) {
        $target_dir = "uploads/invoices/";
        if (!is_dir($target_dir)) mkdir($target_dir, 0777, true);
        $target_file = $target_dir . basename($_FILES['invoice_img']['name']);
        move_uploaded_file($_FILES['invoice_img']['tmp_name'], $target_file);
        $invoice_img = $target_file;
    }

$sql = "UPDATE payment_details SET 
            clients_id='$clients_id', 
            payment='$payment', 
            payment_received='$payment_received',
            payment_received_date='$payment_received_date', 
            payment_remaining='$payment_remaining',
            service_taken='$service_taken',
            amount_details='$amount_details',
            invoice_number='$invoice_number',
            invoice_img='$invoice_img',
            notes='$notes', 
            comments='$comments'
            WHERE id='$id'";

if (mysqli_query($conn, $sql)) {
        header("Location: payment_details_list.php?msg=Payment details updated successfully");
        exit;
    } else {
        echo "Error: " . mysqli_error($conn);
    }
}
?>

<div class="page-body">
  <div class="container-fluid">
    <div class="card">
      <div class="card-header"><h4>Edit Payment Details</h4></div>
      <div class="card-body">
        <form method="POST" enctype="multipart/form-data">
          <div class="row g-3">
            
            
            <div class="col-md-6">
              <label>Client</label>
              <select name="clients_id" class="form-select" required>
                <?php
                $clients = mysqli_query($conn, "SELECT id, name FROM clients ORDER BY name ASC");
                while ($c = mysqli_fetch_assoc($clients)) {
                    $sel = ($c['id'] == $row['clients_id']) ? 'selected' : '';
                    echo "<option value='{$c['id']}' $sel>{$c['name']}</option>";
                }
                ?>
              </select>
            </div>

<div class="col-md-6">
              <label>Service Taken</label>
              <?php $selected_services = explode(',', $row['service_taken']); ?>
              <select name="service_taken[]" class="form-select" multiple>
                <?php
                $services = ["Website Development", "Digital Marketing", "CRM Development", "Graphic Designing", "Video Production", "Web Hosting", "Web Domain", "Bulk Whatsapp", "Others"];
                foreach ($services as $s) {
                    $sel = in_array($s, $selected_services) ? 'selected' : '';
                    echo "<option value='$s' $sel>$s</option>";
                }
                ?>
              </select>
            </div>

<div class="col-md-4">
              <label>Total Payment (₹)</label>
              <input type="number" step="0.01" name="payment" id="payment" class="form-control" value="<?= $row['payment'] ?>">
            </div>

<div class="col-md-4">
              <label>Payment Received (₹)</label>
              <input type="number" step="0.01" name="payment_received" id="payment_received" class="form-control" value="<?= $row['payment_received'] ?>">
            </div>

<div class="col-md-4">
              <label>Payment Remaining (₹)</label>
              <input type="number" step="0.01" name="payment_remaining" id="payment_remaining" class="form-control" value="<?= $row['payment_remaining'] ?>" readonly>
            </div>

<div class="col-md-4">
              <label>Payment Date</label>
              <input type="date" name="payment_received_date" class="form-control" value="<?= $row['payment_received_date'] ?>">
            </div>

<div class="col-md-4">
              <label>Invoice Number</label>
              <input type="text" name="invoice_number" class="form-control" value="<?= $row['invoice_number'] ?>">
            </div>

<div class="col-md-4">
              <label>Invoice Image</label>
              <input type="file" name="invoice_img" class="form-control" accept="image/*">
              <?php if (!empty($row['invoice_img'])): ?>
                <small>Current: <a href="<?= $row['invoice_img'] ?>" target="_blank">View</a></small>
              <?php endif; ?>
            </div>
            
            
            <div class="col-md-4">
              <label>Amount Details</label>
              <textarea name="amount_details" class="form-control" rows="3"><?= $row['amount_details'] ?></textarea>
            </div>

<div class="col-md-4">
              <label>Notes</label>
              <textarea name="notes" class="form-control"  rows="3"><?= $row['notes'] ?></textarea>
            </div>

<div class="col-md-4">
              <label>Comments</label> 
              <textarea name="comments" class="form-control"  rows="3"><?= $row['comments'] ?></textarea>
            </div>

</div>

<div class="mt-3">
            <button type="submit" class="btn btn-success">Update</button>
            <a href="payment_details_list.php" class="btn btn-secondary">Cancel</a>
          </div>
        </form>
      </div>
    </div>
  </div>
</div>

<script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>
<script>
$(document).ready(function() {
  function calculateRemaining() {
    let total = parseFloat($('#payment').val()) || 0;
    let received = parseFloat($('#payment_received').val()) || 0;
    let remaining = total - received;
    if (remaining < 0) remaining = 0;
    $('#payment_remaining').val(remaining.toFixed(2));
  }
  $('#payment, #payment_received').on('input', calculateRemaining);
});
</script>

<?php include 'footer.php'; ob_end_flush(); ?>