Zploit 0-Day Shell

:: Editing File: ticket_edit.php

<?php 
ob_start();
include 'header.php';

/* Breadcrumb setup */
$page_title = "Edit Ticket";
$page_parent = "Tickets";
$page_parent_link = "ticket_list.php";

include 'breadcrumb.php';
include 'menu.php';

$message = "";
$ticket = null;

// ✅ Validate & fetch ticket
if (isset($_GET['id']) && is_numeric($_GET['id'])) {
    $ticket_id = intval($_GET['id']);

$query = "SELECT * FROM tickets WHERE id = $ticket_id";
    $result = mysqli_query($conn, $query);

if ($result && mysqli_num_rows($result) > 0) {
        $ticket = mysqli_fetch_assoc($result);
    } else {
        $message = "Ticket not found.";
    }
} else {
    $message = "Invalid Ticket ID.";
}

// ✅ Handle form submission
if ($_SERVER['REQUEST_METHOD'] === 'POST' && $ticket) {

$subject = mysqli_real_escape_string($conn, $_POST['subject']);
    $msg_text = mysqli_real_escape_string($conn, $_POST['message']);
    $status   = mysqli_real_escape_string($conn, $_POST['status']);

$attachment_path = $ticket['attachment']; // keep old by default

// ✅ Handle new attachment upload
    if (!empty($_FILES['attachment']['name'])) {

$target_dir = "uploads/tickets/";
        if (!is_dir($target_dir)) {
            mkdir($target_dir, 0777, true);
        }

$file_name = basename($_FILES['attachment']['name']);
        $file_ext  = strtolower(pathinfo($file_name, PATHINFO_EXTENSION));

$allowed_ext = ['jpg','jpeg','png','pdf','doc','docx'];

if (!in_array($file_ext, $allowed_ext)) {
            $message = "Allowed files: JPG, PNG, PDF, DOC, DOCX";
        } else {

$new_file_name = time() . "_" . preg_replace("/[^a-zA-Z0-9_\.-]/", "_", $file_name);
            $target_file = $target_dir . $new_file_name;

if (move_uploaded_file($_FILES['attachment']['tmp_name'], $target_file)) {

// delete old attachment
                if (!empty($ticket['attachment']) && file_exists($target_dir . $ticket['attachment'])) {
                    unlink($target_dir . $ticket['attachment']);
                }

$attachment_path = $new_file_name;

} else {
                $message = "Error uploading attachment.";
            }
        }
    }

// ✅ Update ticket
    if ($message == '') {
        $sql = "UPDATE tickets 
                SET subject='$subject',
                    message='$msg_text',
                    attachment='$attachment_path',
                    status='$status',
                    updated_at=NOW()
                WHERE id=$ticket_id";

if (mysqli_query($conn, $sql)) {
            header("Location: ticket_list.php?msg=Ticket updated successfully");
            exit;
        } else {
            $message = "Database Error: " . mysqli_error($conn);
        }
    }
}
?>

<div class="page-body">
<div class="container-fluid">
<div class="row">
<div class="col-sm-12">

<div class="card">
<div class="card-header pb-0 card-no-border">
    <h2>Edit Ticket</h2>
</div>

<?php if ($message): ?>
    <div class="alert alert-warning"><?= htmlspecialchars($message); ?></div>
<?php endif; ?>

<?php if ($ticket): ?>
<form method="POST" enctype="multipart/form-data">

<div class="col-md-6">
    <label class="form-label">Subject</label>
    <input type="text" name="subject" class="form-control"
           value="<?= htmlspecialchars($ticket['subject']); ?>" required>
</div>

<div class="col-md-6">
    <label class="form-label">Status</label>
    <select name="status" class="form-control">
        <option value="open" <?= $ticket['status']=='open'?'selected':''; ?>>Open</option>
        <option value="in_progress" <?= $ticket['status']=='in_progress'?'selected':''; ?>>In Progress</option>
        <option value="closed" <?= $ticket['status']=='closed'?'selected':''; ?>>Closed</option>
    </select>
</div>

<div class="col-md-12 mt-3">
    <label class="form-label">Message</label>
    <textarea name="message" class="form-control" rows="4" required><?= htmlspecialchars($ticket['message']); ?></textarea>
</div>

<div class="col-md-6 mt-3">
    <label class="form-label">Replace Attachment</label>
    <input type="file" name="attachment" class="form-control">
</div>

<?php if (!empty($ticket['attachment'])): ?>
<div class="col-md-6 mt-4">
    <label class="form-label">Current Attachment</label><br>
    <a href="uploads/tickets/<?= htmlspecialchars($ticket['attachment']); ?>" 
       target="_blank" class="btn btn-primary btn-sm">
        View File
    </a>
</div>
<?php endif; ?>

</div>

<br>
<div class="text-start">
    <button type="submit" class="btn btn-success">Update Ticket</button>
    <a href="ticket_list.php" class="btn btn-secondary">Cancel</a>
</div>

</form>
<?php endif; ?>

</div>
</div>

</div>
</div>
</div>
</div>

<?php
include 'footer.php';
ob_end_flush();
?>