Zploit 0-Day Shell

:: Editing File: work_sections_edit.php

<?php
ob_start();
include 'header.php';
$page_title = "Edit Work Section";
include 'breadcrumb.php';
include 'menu.php';

if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    header("Location: work_sections_list.php?msg=Invalid Request");
    exit;
}

$id = intval($_GET['id']);
$query = mysqli_query($conn, "SELECT * FROM work_sections WHERE id = $id");
$section = mysqli_fetch_assoc($query);

if (!$section) {
    header("Location: work_sections_list.php?msg=Section Not Found");
    exit;
}

$message = "";

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $section_name = mysqli_real_escape_string($conn, $_POST['section_name']);
    $description = mysqli_real_escape_string($conn, $_POST['description']);

if (!empty($section_name)) {
        $sql = "UPDATE work_sections 
                SET section_name='$section_name', description='$description', updated_at=NOW()
                WHERE id=$id";
        if (mysqli_query($conn, $sql)) {
            header("Location: work_sections_list.php?msg=Work Section Updated Successfully");
            exit;
        } else {
            $message = "Database Error: " . mysqli_error($conn);
        }
    } else {
        $message = "Section name is required.";
    }
}
?>

<div class="page-body">
  <div class="container-fluid">
    <div class="card">
      <div class="card-header pb-0">
        <h2>Edit Work Section</h2>
      </div>
      <div class="card-body">
        <?php if ($message): ?>
          <div class="alert alert-danger"><?= $message; ?></div>
        <?php endif; ?>
        <form method="POST">
          <div class="row g-3">
            <div class="col-md-6">
              <label class="form-label">Section Name</label>
              <input type="text" name="section_name" value="<?= htmlspecialchars($section['section_name']); ?>" class="form-control" required>
            </div>
            <div class="col-md-6">
              <label class="form-label">Description</label>
              <textarea name="description" class="form-control" rows="3"><?= htmlspecialchars($section['description']); ?></textarea>
            </div>
          </div>
          <div class="mt-4">
            <button type="submit" class="btn btn-success">Update</button>
            <a href="work_sections_list.php" class="btn btn-secondary">Cancel</a>
          </div>
        </form>
      </div>
    </div>
  </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>