Zploit 0-Day Shell

:: Editing File: team_members_edit.php

<?php
ob_start();
include 'header.php';

$page_title = "Edit Team Member";
$page_parent = "Team Members";
$page_parent_link = "team_members_list.php";

include 'breadcrumb.php';
include 'menu.php';

if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    header("Location: team_members_list.php?msg=Invalid Request");
    exit;
}

$id = intval($_GET['id']);
$query = mysqli_query($conn, "SELECT * FROM team_members WHERE id = $id");
$member = mysqli_fetch_assoc($query);

if (!$member) {
    header("Location: team_members_list.php?msg=Member Not Found");
    exit;
}

$message = "";

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $name = mysqli_real_escape_string($conn, $_POST['name']);
    $position = mysqli_real_escape_string($conn, $_POST['position']);
    $employee_id = mysqli_real_escape_string($conn, $_POST['employee_id']);
    $joining_date = mysqli_real_escape_string($conn, $_POST['joining_date']);
    $address = mysqli_real_escape_string($conn, $_POST['address']);
    $contact_number = mysqli_real_escape_string($conn, $_POST['contact_number']);
    $email_id = mysqli_real_escape_string($conn, $_POST['email_id']);

$sql = "UPDATE team_members 
            SET 
                name = '$name',
                position = '$position',
                employee_id = '$employee_id',
                joining_date = '$joining_date',
                address = '$address',
                contact_number = '$contact_number',
                email_id = '$email_id'
            WHERE id = $id";

if (mysqli_query($conn, $sql)) {
        header("Location: team_members_list.php?msg=Team Member Updated Successfully");
        exit;
    } else {
        $message = "Database Error: " . mysqli_error($conn);
    }
}
?>

<div class="page-body">
  <div class="container-fluid">
    <div class="card">
      <div class="card-header pb-0">
        <h2>Edit Team Member</h2>
      </div>

<div class="col-md-6">
              <label class="form-label">Name</label>
              <input type="text" name="name" value="<?= htmlspecialchars($member['name']); ?>" class="form-control" required>
            </div>

<div class="col-md-6">
              <label class="form-label">Position</label>
              <input type="text" name="position" value="<?= htmlspecialchars($member['position']); ?>" class="form-control" required>
            </div>

<div class="col-md-6">
              <label class="form-label">Employee ID</label>
              <input type="text" name="employee_id" value="<?= htmlspecialchars($member['employee_id']); ?>" class="form-control" required>
            </div>

<div class="col-md-6">
              <label class="form-label">Joining Date</label>
              <input type="date" name="joining_date" value="<?= htmlspecialchars($member['joining_date']); ?>" class="form-control" required>
            </div>

<div class="col-md-12">
              <label class="form-label">Address</label>
              <textarea name="address" class="form-control" rows="2" required><?= htmlspecialchars($member['address']); ?></textarea>
            </div>

<div class="col-md-6">
              <label class="form-label">Contact Number</label>
              <input type="text" name="contact_number" value="<?= htmlspecialchars($member['contact_number']); ?>" class="form-control" maxlength="15" required>
            </div>

<div class="col-md-6">
              <label class="form-label">Email ID</label>
              <input type="email" name="email_id" value="<?= htmlspecialchars($member['email_id']); ?>" class="form-control" required>
            </div>

</div>

<div class="mt-4">
            <button type="submit" class="btn btn-success">Update</button>
            <a href="team_members_list.php" class="btn btn-secondary">Cancel</a>
          </div>
        </form>
      </div>
    </div>
  </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>