Zploit 0-Day Shell

:: Editing File: genrated_vendor_invoice.php

<?php
require('fpdf/fpdf.php');
include 'db.php';

// Get invoice master data
//$invoice_id = '1' // pass invoice id in URL

$invoice_id = '1';
/*$sql = "SELECT vi.*, v.name, v.email, v.phone, v.address 
        FROM vendor_invoices vi 
        JOIN vendors v ON vi.vendor_id = v.id 
        WHERE vi.id = $invoice_id";
		*/

$res = $conn->query("SELECT vi.*, v.name, v.email, v.phone, v.address 
                       FROM vendor_invoices vi 
                       JOIN vendors v ON vi.vendor_id = v.id 
                       WHERE vi.id = $invoice_id");
$invoice = $res->fetch_assoc();

// Assign variables
$vendor_name    = $invoice['name'];
$vendor_email   = $invoice['email'];
$vendor_phone   = $invoice['phone'];
$vendor_address = $invoice['address'];

$invoice_no     = $invoice['invoice_no'];
$challan     = $invoice['challan'];
$invoice_date   = $invoice['invoice_date'];

$delivery_name    = $invoice['billing_address']; // or another field if available
$delivery_phone   = $invoice['billing_email'];
$delivery_address = $invoice['delivery_address'];
$delivery_date    = $invoice['delivery_date'];

$driver_name   = $invoice['driver_name'];
$driver_number = $invoice['driver_number'];
$vehicle_number= $invoice['vehicle_number'];
$total_boxes   = $invoice['total_boxes'];

$sign_left     = $invoice['sign_for_company_left'];
$sign_right    = $invoice['sign_for_company_right'];

// Generate PDF
$pdf = new FPDF();
$pdf->AddPage();

// Header
$pdf->SetFont('Arial','B',16);
$pdf->Cell(190,10,"INVOICE",0,1,'C');
$pdf->Ln(5);

// Vendor Info
$pdf->SetFont('Arial','',12);
$pdf->Cell(95,10,"Vendor: $vendor_name",0,0);
$pdf->Cell(95,10,"Invoice No: $invoice_no",0,1);
$pdf->Cell(95,10,"Challan: $challan",0,0);
$pdf->Cell(95,10,"Date: $invoice_date",0,1);
$pdf->MultiCell(190,10,"Vendor Address: $vendor_address");

// Delivery Info
$pdf->Ln(5);
$pdf->SetFont('Arial','B',12);
$pdf->Cell(190,10,"Delivery Information",0,1);
$pdf->SetFont('Arial','',12);
$pdf->MultiCell(95,10,"Receiver: $delivery_name");
$pdf->Cell(95,10,"Delivery Date: $delivery_date",0,1);
$pdf->Cell(95,10,"Phone: $delivery_phone",0,1);
$pdf->MultiCell(190,10,"Address: $delivery_address");

// Items Table
$pdf->Ln(7);
$pdf->SetFont('Arial','B',11);
$pdf->Cell(10,10,"#",1);
$pdf->Cell(60,10,"Description",1);
$pdf->Cell(50,10,"UOM",1);
$pdf->Cell(20,10,"Qty",1);
$pdf->Cell(20,10,"Rate",1);
$pdf->Cell(20,10,"Amount",1,1);

$pdf->SetFont('Arial','',11);
$total = 0;
$resItems = $conn->query("SELECT * FROM vendor_invoice_items WHERE invoice_id=$invoice_no");
$i=1;
while($row=$resItems->fetch_assoc()) {
    $pdf->Cell(10,10,$i++,1);
    $pdf->Cell(60,10,$row['description'],1);
    $pdf->Cell(50,10,$row['uom'],1);
    $pdf->Cell(20,10,$row['qty'],1);
    $pdf->Cell(20,10,$row['rate'],1);
    $pdf->Cell(20,10,$row['amount'],1,1);
    $total += $row['amount'];
}
$pdf->SetFont('Arial','B',14);
$pdf->Cell(150,10,"Total",1);
$pdf->Cell(30,10,number_format($total,2),1,1);

// Driver Info
$pdf->Ln(5);
$pdf->SetFont('Arial','B',12);
$pdf->Cell(190,10,"Driver & Vehicle Info",0,1);
$pdf->SetFont('Arial','',12);
$pdf->Cell(95,10,"Driver: $driver_name",0,0);
$pdf->Cell(95,10,"Driver No: $driver_number",0,1);
$pdf->Cell(95,10,"Vehicle No: $vehicle_number",0,0);
$pdf->Cell(95,10,"Total Boxes: $total_boxes",0,1);

// Signatures
$pdf->Ln(15);
$pdf->SetFont('Arial','B',12);
$pdf->Cell(95,10,"For - $sign_left",0,0,'C');
$pdf->Cell(95,10,"For - $sign_right",0,1,'C');

$pdf->Ln(20);
$pdf->SetFont('Arial','',12);
$pdf->Cell(95,10,"Authorized Signatory",0,0,'C');
$pdf->Cell(95,10,"Authorized Signatory",0,1,'C');

// Output PDF in browser
$pdf->Output("I","invoice.pdf");
?>