Zploit 0-Day Shell

:: Editing File: vcard_media_edit.php

<?php
ob_start();
include 'header.php';

$page_title = "Edit VCard Media";
$page_parent = "VCards";
$page_parent_link = "vcard_media_list.php";

include 'breadcrumb.php';
include 'menu.php';

define('VCARD_UPLOAD_PATH', $_SERVER['DOCUMENT_ROOT'].'/kreativecrm/uploads/vcard/');

$id = intval($_GET['id']);

$q = mysqli_query($conn,"SELECT * FROM vcard_media WHERE id='$id'");
$row = mysqli_fetch_assoc($q);

$v = mysqli_query($conn,"SELECT card_slug FROM vcards WHERE id='{$row['vcard_id']}'");
$vcard = mysqli_fetch_assoc($v);

$slug = $vcard['card_slug'];
$upload_dir = VCARD_UPLOAD_PATH.$slug.'/media/';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$vcard_id   = intval($_POST['vcard_id']);
    $type       = $_POST['type'];
    $status     = isset($_POST['status']) ? 1 : 0;

/* FILE */
    $file_path = $row['file_path'];
    if ($row['type']!='video' && !empty($_FILES['file']['name'])) {
        if ($file_path && file_exists($upload_dir.$file_path)) {
            unlink($upload_dir.$file_path);
        }
        $ext = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
        $file_path = time().'_media.'.$ext;
        move_uploaded_file($_FILES['file']['tmp_name'], $upload_dir.$file_path);
    }

/* THUMBNAIL */
    $image_path = $row['image_path'];
    if (!empty($_FILES['image_path']['name'])) {
        if ($image_path && file_exists($upload_dir.$image_path)) {
            unlink($upload_dir.$image_path);
        }
        $ext = pathinfo($_FILES['image_path']['name'], PATHINFO_EXTENSION);
        $image_path = time().'_thumb.'.$ext;
        move_uploaded_file($_FILES['image_path']['tmp_name'], $upload_dir.$image_path);
    }

mysqli_query($conn,"
        UPDATE vcard_media SET
        file_path='$file_path',
        type='$type',
        vcard_id='$vcard_id',
        image_path='$image_path',
        status='$status'
        WHERE id='$id'
    ");

header("Location: vcard_media_list.php?msg=Media Updated");
    exit;
}
?>

<div class="page-body">
<div class="container-fluid">
<div class="row">
<div class="col-sm-12">

<div class="card">
<div class="card-header pb-0 card-no-border">
    <h2>Edit VCard Media</h2>
</div>

<div class="col-md-6 mb-3">
<label class="form-label">Select VCard *</label>
<select name="vcard_id" class="form-control" required>
<?php
$vcards = mysqli_query($conn, "SELECT id, full_name FROM vcards WHERE status=1 ORDER BY full_name");
while ($v = mysqli_fetch_assoc($vcards)) {
    $sel = ($v['id'] == $row['vcard_id']) ? 'selected' : '';
    echo "<option value='{$v['id']}' $sel>" . htmlspecialchars($v['full_name']) . "</option>";
}
?>
</select>
</div>

<div class="col-md-6 mb-3">
<label class="form-label">Media Type *</label>
<select name="type" class="form-control" id="mediaType" required>
    <option value="image" <?= $row['type']=='image'?'selected':''; ?>>Image</option>
    <option value="qr" <?= $row['type']=='qr'?'selected':''; ?>>QR</option>
    <option value="file" <?= $row['type']=='file'?'selected':''; ?>>File</option>
    <option value="video" <?= $row['type']=='video'?'selected':''; ?>>Video</option>
</select>
</div>

<div class="col-md-4 mb-3" id="fileBox">
<label class="form-label">Upload File</label>
<input type="file" name="file_path" class="form-control">
<?php if ($row['file_path']): ?>
    <div class="mt-1 text-muted"><?= htmlspecialchars($row['file_path']); ?></div>
<?php endif; ?>
</div>

<div class="col-md-4 mb-3" id="urlBox">
<label class="form-label">Video URL</label>
<input type="url" name="url" class="form-control"
       value="<?= htmlspecialchars($row['url']); ?>">
</div>

<div class="col-md-4 mb-3" id="fileBox">
<label class="form-label">Thumbnil Upload File</label>
<input type="file" name="image_path" class="form-control">
<?php if ($row['image_path']): ?>
    <div class="mt-1 text-muted"><?= htmlspecialchars($row['image_path']); ?></div>
<?php endif; ?>
</div>

<div class="col-md-3 mb-3">
<label class="form-label">Status</label><br>
<input type="checkbox" name="status" <?= ($row['status']==1)?'checked':''; ?>> Active
</div>

</div>

<br>
<button type="submit" class="btn btn-success">Update Media</button>
<a href="vcard_media_list.php" class="btn btn-secondary">Cancel</a>

</form>

</div>
</div>

</div>
</div>
</div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>