Zploit 0-Day Shell

:: Editing File: quotation_list.php

<?php
include 'config/db.php';
include 'check_login.php';

// ✅ Validate the Quotation ID
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    header("Location: quotation_list.php?msg=Invalid Quotation ID");
    exit;
}

$q_id = intval($_GET['id']);

// ✅ Check if quotation exists
$check_sql = "SELECT id, pdf_path FROM quotation WHERE id = $q_id";
$check_res = mysqli_query($conn, $check_sql);

if (mysqli_num_rows($check_res) === 0) {
    header("Location: quotation_list.php?msg=Quotation not found");
    exit;
}

$row = mysqli_fetch_assoc($check_res);
$pdf_path = $row['pdf_path'];

// ✅ Delete PDF file (if exists)
if (!empty($pdf_path) && file_exists($pdf_path)) {
    unlink($pdf_path);
}

// ✅ Delete quotation record
$delete_sql = "DELETE FROM quotation WHERE id = $q_id";

if (mysqli_query($conn, $delete_sql)) {
    header("Location: quotation_list.php?msg=Quotation deleted successfully");
    exit;
} else {
    $error = urlencode(mysqli_error($conn));
    header("Location: quotation_list.php?msg=Error deleting quotation: $error");
    exit;
}
?>