Zploit 0-Day Shell

:: Editing File: send_otp.php

<?php
include('db_config.php');

// Include PEAR Mail library
require_once ('Mail.php');

if ($_SERVER["REQUEST_METHOD"] == "POST" && !empty($_POST['email'])) {
    $email = $conn->real_escape_string($_POST['email']);

// 1. CRITICAL CHECK: Verify if the user exists AND is_paid = 1
    $sql = "SELECT * FROM users WHERE email = '$email' AND is_paid = 1";
    $result = $conn->query($sql);

if ($result->num_rows > 0) {
        // User is paid. Proceed with OTP generation and sending.
        $user = $result->fetch_assoc();
        $otp = rand(1000, 9999);
        $otp_expiry = time() + OTP_EXPIRY_SECONDS; // OTP expires in 5 minutes

// 2. Store the OTP and expiry time in the database
        $stmt = $conn->prepare("UPDATE users SET otp = ?, otp_expiry = ? WHERE email = ?");
        $stmt->bind_param("sis", $otp, $otp_expiry, $email);
        $stmt->execute();
        
        // 3. Send the OTP via PEAR Mail (SMTP)
        $to = $email;
        $subject = "Your CRM Login One-Time Password";
        
        $body = "Dear " . $user['username'] . ",\n\n";
        $body .= "Your One-Time Password (OTP) for CRM Login is: " . $otp . "\n";
        $body .= "This OTP will expire in 5 minutes.\n\n";
        $body .= "Do not share this code with anyone.\n\n";
        $body .= "Thank You.";

$headers = array(
            'From' => SMTP_EMAIL_FROM,
            'To' => $to,
            'Cc' => SMTP_EMAIL_CC, // Added CC
            'Subject' => $subject
        );

$smtp = Mail::factory('smtp', array(
            'host' => SMTP_HOST,
            'port' => SMTP_PORT,
            'auth' => true,
            'username' => SMTP_USERNAME,
            'password' => SMTP_PASSWORD
        ));

// Send the mail to TO and CC recipients
        $mail = $smtp->send($to . ', ' . SMTP_EMAIL_CC, $headers, $body);

if (PEAR::isError($mail)) {
            // Email sending failed
            $error = "Failed to send OTP email: " . $mail->getMessage();
            header("location: index.php?error=" . urlencode($error));
        } else {
            // Success: Redirect to OTP verification page
            header("location: verify_otp.php?email=" . urlencode($email));
        }

} else {
        // FAILURE: User is NOT PAID (is_paid = 0) or doesn't exist.
        $error = "Access Denied. You must have a **paid account** to log in.";
        header("location: index.php?error=" . urlencode($error));
    }
} else {
    header("location: index.php");
}

$conn->close();
exit;
?>