Zploit 0-Day Shell

:: Editing File: farmers_challen_list.php

<?php

error_reporting(E_ALL);
ini_set('display_errors', '1');

include_once("session.php");

include("header.php"); 
include("db.php");
?>
<link href="assets/vendor/datatable/jquery.dataTables.min.css" rel="stylesheet" type="text/css">

<div class="row m-1">
            <div class="col-9">
                <h4 class="main-title">Farmer Challen</h4>
                <ul class="app-line-breadcrumbs mb-3">
                    <li>
                        <a class="f-s-14 f-w-500" href="dashboard.php">
                            <i class="ph-duotone ph-bank f-s-16"></i> Home
                        </a>
                    </li>
                    <li class="active">
                        <a class="f-s-14 f-w-500" href="#">Farmer Challen</a>
                    </li>
                </ul>
            </div>
            <div class="col-3">
                <a href="farmer_challen_add.php" class="btn btn-primary" style="float: right;">Add Farmer Challen</a>
            </div>
        </div>

<div class="row">
            <div class="col-12">
                <div class="card ">
                    <div class="card-body p-0">
                        <div class="app-datatable-default overflow-auto">

<table class="display app-data-table default-data-table" id="example2">
						<thead>
							<tr>
								<th>Challan No</th>
								<th>Farmer Name</th>
								<th>Vendor Name</th>
								
								<th>Name of Supervisor</th>
								<th>Total Box</th>
								<th>Total Wastage KG</th>
								<th>Time</th>
								<th>Action</th>
								
							</tr>
						</thead>
						<tbody>
							<?php
							// CHANGED: Corrected the entire SQL query
							  $sql = "SELECT 
										c.id, 
										c.challan_no, 
										c.grand_total_box, 
										c.grand_wastage_kg,
										c.supervisior_name, 
										c.dispatch_time,
										p_farmer.name AS farmer_name, /* Get farmer name from party table */
										c.challan_receipt,
										p_vendor.name AS vendor_name  /* Get vendor name from party table */
									FROM 
										challan AS c
									LEFT JOIN 
										party AS p_farmer ON c.farmer_id = p_farmer.id /* Join for farmer */
									LEFT JOIN 
										party AS p_vendor ON c.vendor_id = p_vendor.id /* Join for vendor */
									ORDER BY 
										c.id DESC"; // Optional: Show the newest challans first

$result = mysqli_query($conn, $sql);

if (mysqli_num_rows($result) > 0) {
									while ($row = mysqli_fetch_assoc($result)) {
									echo "<tr>";
									echo "<td>" . htmlspecialchars($row['challan_no']) . "</td>";
									echo "<td>" . htmlspecialchars($row['farmer_name']) . "</td>";
									echo "<td>" . htmlspecialchars($row['vendor_name']) . "</td>";
									echo "<td>" . htmlspecialchars($row['supervisior_name']) . "</td>"; // CHANGED: Corrected column name
									echo "<td>" . htmlspecialchars($row['grand_total_box']) . "</td>"; // CHANGED: Corrected column nam
									echo "<td>" . htmlspecialchars($row['grand_wastage_kg']) . "</td>"; // CHANGED: Corrected column nam
									echo "<td>" . date("d-m-Y g:i A", strtotime($row['dispatch_time'])) . "</td>";   // ADDED: Missing time column
									
									
									
									echo "<td>";
									
									if (!empty($row['challan_receipt'])) {
										echo " 
										<a target='_blank' href='uploads/challan_receipts/" . $row['challan_receipt'] . "' class='btn btn-light-danger icon-btn b-r-4'>
											<i class='ti ti-file text-danger' aria-hidden='true'></i>
										</a> ";
									}
									
									echo "<a target='_blank' href='genrated_farmer_challen.php?id=" . $row['id'] . "' class='btn btn-light-success icon-btn b-r-4'>
										<i class='ti ti-printer text-success'></i>
									</a>";

echo "
										<a target='_blank' href='edit_challan.php?id=".$row['id']."' class='btn btn-light-primary icon-btn b-r-4'>
											<i class='ti ti-edit text-primary' title='edit-challan'></i>
										</a>

<a href='delete_challan.php?id=".$row['id']."' class='btn btn-light-danger icon-btn b-r-4'
										   onclick=\"return confirm('Are you sure you want to delete this challan?');\">
											<i class='ti ti-trash text-danger'></i>
										</a>
									  </td>";
								echo "</tr>";

}
								} else {
									// CHANGED: The colspan should be 8 to match the number of columns
									echo "<tr><td colspan='8' class='text-center'>No challans found</td></tr>";
								}
							?>
						</tbody>
					</table>
                        </div>
                    </div>
                </div>
            </div>
        </div>

</div>
</main>

<?php include "footer.php"; ?>

<script src="assets/vendor/datatable/jquery-3.5.1.js"></script>

<script src="assets/vendor/datatable/jquery.dataTables.min.js"></script>
<script src="assets/js/data_table.js"></script>

<link rel="stylesheet" href="https://cdn.datatables.net/buttons/2.4.1/css/buttons.dataTables.min.css">
<script src="https://cdn.datatables.net/buttons/2.4.1/js/dataTables.buttons.min.js"></script>
<script src="https://cdn.datatables.net/buttons/2.4.1/js/buttons.html5.min.js"></script>
<script src="https://cdn.datatables.net/buttons/2.4.1/js/buttons.print.min.js"></script>

<script src="https://cdnjs.cloudflare.com/ajax/libs/jszip/3.10.1/jszip.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/pdfmake/0.2.7/pdfmake.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/pdfmake/0.2.7/vfs_fonts.js"></script>