Zploit 0-Day Shell

:: Editing File: invoice_update.php

<?php
include 'check_login.php';
	include 'config/db.php';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

// Get and sanitize main invoice data
    $invoice_id       = intval($_POST['invoice_id']);
    $client_id        = intval($_POST['client_id']);
    // $party_name       = mysqli_real_escape_string($conn, $_POST['party_name']);
    $party_name = isset($_POST['party_name']) ? mysqli_real_escape_string($conn, $_POST['party_name']) : '';

$invoice_no       = mysqli_real_escape_string($conn, $_POST['invoice_no']);
    $invoice_date     = mysqli_real_escape_string($conn, $_POST['invoice_date']);
    $payment_mode     = mysqli_real_escape_string($conn, $_POST['payment_mode']);
    $receiver_gstin   = isset($_POST['receiver_gstin']) ? mysqli_real_escape_string($conn, $_POST['receiver_gstin']) : '';
    $receiver_address = isset($_POST['receiver_address']) ? mysqli_real_escape_string($conn, $_POST['receiver_address']) : '';
    $sub_total        = floatval($_POST['sub_total']);
    $tax_total        = floatval($_POST['tax_total']);
    // --- NEW FIELD: ADVANCE AMOUNT ---
    $advance_amount     = floatval($_POST['advance_amount']);
    
    $grand_total      = floatval($_POST['grand_total']);

// Update invoice main table
    $update_invoice = "
        UPDATE invoices SET
            client_id = '$client_id',
            invoice_no = '$invoice_no',
            invoice_date = '$invoice_date',
            payment_mode = '$payment_mode',
            receiver_gstin = '$receiver_gstin',
            receiver_address = '$receiver_address',
            sub_total = '$sub_total',
            tax_total = '$tax_total',
            advance_amount = '$advance_amount',
            grand_total = '$grand_total'
        WHERE id = '$invoice_id'
    ";

if (mysqli_query($conn, $update_invoice)) {

// Remove old items first
        mysqli_query($conn, "DELETE FROM invoice_items WHERE invoice_id = '$invoice_id'");

// Prepare new items
        $descriptions = $_POST['description'] ?? [];
        $hsn_codes = $_POST['hsn_code'] ?? [];
        $prices = $_POST['price'] ?? [];
        $quantities = $_POST['quantity'] ?? [];
        $tax_percents = $_POST['tax_percent'] ?? [];
        $taxable_amounts = $_POST['taxable_amount'] ?? [];

$item_count = count($descriptions);

for ($i = 0; $i < $item_count; $i++) {
            $desc = mysqli_real_escape_string($conn, $descriptions[$i]);
            $hsn = mysqli_real_escape_string($conn, $hsn_codes[$i]);
            $price = floatval($prices[$i]);
            $qty = floatval($quantities[$i]);
            $tax = floatval($tax_percents[$i]);
            $taxable = floatval($taxable_amounts[$i]);

if (!empty($desc)) {
                mysqli_query($conn, "
                    INSERT INTO invoice_items (invoice_id, description, hsn_code, price, quantity, tax_percent, taxable_amount)
                    VALUES ('$invoice_id', '$desc', '$hsn', '$price', '$qty', '$tax', '$taxable')
                ");
            }
        }

// Redirect with success
        $_SESSION['success_msg'] = "Invoice updated successfully!";
        header("Location: invoice.php");
        exit;

} else {
        $_SESSION['error_msg'] = "Error updating invoice: " . mysqli_error($conn);
        header("Location: invoice_edit.php?payment_id=$payment_id");
        exit;
    }

} else {
    header("Location: invoice.php");
    exit;
}
?>