Zploit 0-Day Shell

:: Editing File: dryfruits_stock_delete.php

<?php
ob_start();
error_reporting(E_ALL);
ini_set('display_errors', 1);

include_once("session.php");
include("db.php");

$user_id = $_SESSION['user_id'] ?? 0;

if (!isset($_GET['id']) || (int)$_GET['id'] <= 0) {
    $_SESSION['error'] = "❌ Invalid Dryfruit Material ID!";
    header("Location: dryfruits_stock_list.php");
    exit;
}

$material_id = (int)$_GET['id'];

mysqli_begin_transaction($conn);

try {
    // 1️⃣ Fetch all stock rows for this material
    $stocks_q = mysqli_query($conn,"
        SELECT id, stock_type, quantity
        FROM packaging_stock
        WHERE product_id = '$material_id'
        ORDER BY id ASC
    ");

$stock_ids = [];
    while ($row = mysqli_fetch_assoc($stocks_q)) {
        $stock_ids[] = $row['id'];
    }

// 2️⃣ Delete stock rows
    if (!empty($stock_ids)) {
        $ids_str = implode(',', $stock_ids);
        mysqli_query($conn,"DELETE FROM packaging_stock WHERE id IN ($ids_str)");
    }

// 3️⃣ Delete the dryfruit material
    $delete_material = mysqli_query($conn,"DELETE FROM packaging_materials WHERE id = '$material_id'");
    if (mysqli_affected_rows($conn) === 0) {
        throw new Exception("Material deletion failed");
    }

mysqli_commit($conn);

$_SESSION['success'] = "✅ Dryfruit Material & Stock deleted successfully! (ID: $material_id)";

mysqli_query($conn,"
        INSERT INTO notifications (user_id, message, type)
        VALUES ('$user_id','Dryfruit Material & Stock deleted (ID: $material_id)','success')
    ");

} catch (Exception $e) {
    mysqli_rollback($conn);

$_SESSION['error'] = "❌ Failed to delete Dryfruit Material & Stock!";

mysqli_query($conn,"
        INSERT INTO notifications (user_id, message, type)
        VALUES ('$user_id','Dryfruit Material deletion failed (ID: $material_id)','error')
    ");
}

header("Location: dryfruits_stock_list.php");
exit;
?>