Zploit 0-Day Shell

:: Editing File: vcard_service_add.php

<?php
ob_start();
include 'header.php';

$page_title = "Add VCard Service";
include 'breadcrumb.php';
include 'menu.php';

/* ===============================
   PATH CONFIG
   =============================== */
define('VCARD_UPLOAD_PATH', $_SERVER['DOCUMENT_ROOT'].'/kreativecrm/uploads/vcard/');

$error = "";

/* ===============================
   FORM SUBMIT
   =============================== */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$vcard_id    = intval($_POST['vcard_id']);
    $title       = mysqli_real_escape_string($conn, $_POST['title']);
    $description = mysqli_real_escape_string($conn, $_POST['description']);
    $sort_order  = intval($_POST['sort_order']);
    $status      = isset($_POST['status']) ? 1 : 0;

$icon = NULL;

/* ===============================
       FETCH VCARD SLUG
       =============================== */
    $vcard_q = mysqli_query($conn, "SELECT card_slug FROM vcards WHERE id='$vcard_id'");
    if (!$vcard_q || mysqli_num_rows($vcard_q) == 0) {
        $error = "Invalid VCard selected.";
    } else {

$vcard = mysqli_fetch_assoc($vcard_q);
        $slug  = $vcard['card_slug'];

$upload_dir = VCARD_UPLOAD_PATH.$slug.'/services/';
        if (!is_dir($upload_dir)) {
            mkdir($upload_dir, 0777, true);
        }

/* ===============================
           ICON UPLOAD
           =============================== */
        if (!empty($_FILES['icon']['name'])) {

$ext  = strtolower(pathinfo($_FILES['icon']['name'], PATHINFO_EXTENSION));
            $icon = time().'_service_'.uniqid().'.'.$ext;

move_uploaded_file(
                $_FILES['icon']['tmp_name'],
                $upload_dir.$icon
            );
        }

/* ===============================
           INSERT DATABASE
           =============================== */
        if ($error == '') {

$sql = "INSERT INTO vcard_services
                    (vcard_id, title, description, icon, sort_order, status, created_at)
                    VALUES (
                        '$vcard_id',
                        '$title',
                        '$description',
                        ".($icon ? "'$icon'" : "NULL").",
                        '$sort_order',
                        '$status',
                        NOW()
                    )";

if (mysqli_query($conn, $sql)) {
                header("Location: vcard_service_list.php?msg=Service Added Successfully");
                exit;
            } else {
                $error = mysqli_error($conn);
            }
        }
    }
}
?>

<div class="page-body">
<div class="container-fluid">
<div class="card">
<div class="card-body">

<?php if ($error): ?>
<div class="alert alert-danger"><?= htmlspecialchars($error); ?></div>
<?php endif; ?>

<label class="form-label">VCard *</label>
<select name="vcard_id" class="form-control" required>
<?php
$q = mysqli_query($conn,"SELECT id, full_name FROM vcards WHERE status=1 ORDER BY full_name");
while($r=mysqli_fetch_assoc($q)){
    echo "<option value='{$r['id']}'>".htmlspecialchars($r['full_name'])."</option>";
}
?>
</select>

<label class="form-label mt-3">Service Title *</label>
<input type="text" name="title" class="form-control" required>

<label class="form-label mt-3">Description</label>
<textarea name="description" class="form-control" rows="4"></textarea>

<label class="form-label mt-3">Service Icon (Image)</label>
<input type="file" name="icon" class="form-control">

<label class="form-label mt-3">Sort Order</label>
<input type="number" name="sort_order" class="form-control" value="0">

<label class="form-label mt-3">
    <input type="checkbox" name="status" checked> Active
</label>

<br><br>
<button type="submit" class="btn btn-success">Save Service</button>
<a href="vcard_service_list.php" class="btn btn-secondary">Cancel</a>

</form>

</div>
</div>
</div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>