Zploit 0-Day Shell

:: Editing File: register_action.php

<?php
include('db_config.php');
// PEAR Mail की अब यहाँ आवश्यकता नहीं है, लेकिन आपको इसकी आवश्यकता 'भुगतान विफलता' की स्थिति में हो सकती है।
// require_once ('Mail.php');

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    
    // Sanitize and collect data
    // (Ensure all fields from register.php are collected here)
    $username = $conn->real_escape_string($_POST['username']);
    $email = $conn->real_escape_string($_POST['email']);
    $mobile_no = $conn->real_escape_string($_POST['mobile_no']);
    $occupation = $conn->real_escape_string($_POST['occupation'] ?? '');
    $message = $conn->real_escape_string($_POST['message'] ?? '');
    
    // 1. Check if the email already exists
    $sql_check = "SELECT id FROM users WHERE email = '$email'";
    $result_check = $conn->query($sql_check);
    
    if ($result_check->num_rows > 0) {
        $user_data = $result_check->fetch_assoc();
        
        // यदि उपयोगकर्ता मौजूद है लेकिन भुगतान नहीं किया गया है (is_paid=0), तो उसे फिर से भुगतान पृष्ठ पर भेजें।
        if ($user_data['is_paid'] == 0) {
            header("location: payment_register.php?email=" . urlencode($email));
            exit;
        } else {
             // Already paid, redirect to login
             header("location: login.php?message=" . urlencode("Account already verified. Please login."));
             exit;
        }
    }
    
    // 2. Insert new user into database (is_paid = 0, OTP/expiry are NULL)
    // Removed OTP fields as payment is the verification step now.
    $sql_insert = "INSERT INTO users (email, username, mobile_no, occupation, message, is_paid) 
                   VALUES (?, ?, ?, ?, ?, 0)";
    
    $stmt = $conn->prepare($sql_insert);
    // 'sssss' means 5 strings
    $stmt->bind_param("sssss", $email, $username, $mobile_no, $occupation, $message);
    
    if ($stmt->execute()) {
        
        // 3. Success: Redirect to Payment Register Page
        header("location: payment_register.php?email=" . urlencode($email));
        exit;
        
    } else {
        $error = "Database Error: Could not save registration.";
        header("location: register.php?error=" . urlencode($error));
    }
    
} else {
    header("location: register.php");
}

$conn->close();
exit;
?>