Zploit 0-Day Shell

:: Editing File: save_vendor_invoice.php

<?php
include_once("session.php");
include("db.php"); // mysqli $conn

ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

// Allow POST only
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    header("Location: vendor_invoice_add.php");
    exit;
}

try {

/* =======================
       BASIC INPUTS
    ======================= */
    $user_id           = $_SESSION['user_id'] ?? 0;
    $invoice_date      = trim($_POST['invoice_date'] ?? '');
    $invoice_no        = trim($_POST['invoice_no'] ?? '');
    $vehicle_number    = trim($_POST['vehicle_number'] ?? '');
    $vendor_id         = (int)($_POST['vendor_id'] ?? 0);
    $product_name      = trim($_POST['product_name'] ?? '');
    $billing_id        = (int)($_POST['billing_id'] ?? 0);
    $terms_of_delivery = trim($_POST['terms_of_delivery'] ?? '');

$tax_cgst_id = ($_POST['tax_cgst'] ?? '') !== '' ? (int)$_POST['tax_cgst'] : null;
    $tax_sgst_id = ($_POST['tax_sgst'] ?? '') !== '' ? (int)$_POST['tax_sgst'] : null;

/* =======================
       ITEM ARRAYS
    ======================= */
    $item_desc  = $_POST['item_desc'] ?? [];
    $pack_type  = $_POST['pack_type'] ?? [];
    $qty        = $_POST['qty'] ?? [];
    $net_weight = $_POST['net_weight'] ?? [];
    $rate       = $_POST['rate'] ?? [];

/* =======================
       VALIDATION
    ======================= */
    if (!$invoice_date || !$invoice_no || $vendor_id <= 0 || $billing_id <= 0) {
        throw new Exception("Required fields missing.");
    }

if (!is_array($item_desc) || count($item_desc) === 0) {
        throw new Exception("Please add at least one invoice item.");
    }

/* =======================
       FILE UPLOAD
    ======================= */
    $invoice_copy_path = null;
    if (!empty($_FILES['invoice_copy']['name'])) {

$allowed = ['pdf','jpg','jpeg','png'];
        $ext = strtolower(pathinfo($_FILES['invoice_copy']['name'], PATHINFO_EXTENSION));

if (!in_array($ext, $allowed)) {
            throw new Exception("Invalid invoice file format.");
        }

$dir = __DIR__ . "/uploads/vendor_invoices/";
        if (!is_dir($dir)) mkdir($dir, 0777, true);

$new_name = uniqid('invoice_') . "." . $ext;
        $dest = $dir . $new_name;

if (!move_uploaded_file($_FILES['invoice_copy']['tmp_name'], $dest)) {
            throw new Exception("Invoice upload failed.");
        }

$invoice_copy_path = "uploads/vendor_invoices/" . $new_name;
    }

/* =======================
       START TRANSACTION
    ======================= */
    mysqli_begin_transaction($conn);

/* =======================
       CALCULATE SUB TOTAL
    ======================= */
    $sub_total = 0;
    $items = [];

for ($i = 0; $i < count($item_desc); $i++) {

$desc = trim($item_desc[$i]);
        $pack = trim($pack_type[$i] ?? '');
        $q    = (float)($qty[$i] ?? 0);
        $wt   = (float)($net_weight[$i] ?? 0);
        $r    = (float)($rate[$i] ?? 0);

$amount = round($wt * $r, 2);
        if ($desc === '' || $amount <= 0) continue;

$sub_total += $amount;

$items[] = compact('desc','pack','q','wt','r','amount');
    }

/* if (count($items) === 0) {
        throw new Exception("No valid invoice items.");
    }*/

/* =======================
       TAX CALCULATION
    ======================= */
    $cgst_percent = 0;
    $sgst_percent = 0;

if ($tax_cgst_id) {
        $q = mysqli_prepare($conn, "SELECT tax_percentage FROM taxes WHERE id=?");
        mysqli_stmt_bind_param($q, "i", $tax_cgst_id);
        mysqli_stmt_execute($q);
        mysqli_stmt_bind_result($q, $cgst_percent);
        mysqli_stmt_fetch($q);
        mysqli_stmt_close($q);
    }

if ($tax_sgst_id) {
        $q = mysqli_prepare($conn, "SELECT tax_percentage FROM taxes WHERE id=?");
        mysqli_stmt_bind_param($q, "i", $tax_sgst_id);
        mysqli_stmt_execute($q);
        mysqli_stmt_bind_result($q, $sgst_percent);
        mysqli_stmt_fetch($q);
        mysqli_stmt_close($q);
    }

$cgst_amount = round($sub_total * $cgst_percent / 100, 2);
    $sgst_amount = round($sub_total * $sgst_percent / 100, 2);
    $grand_total = round($sub_total + $cgst_amount + $sgst_amount, 2);

/* =======================
       INSERT INVOICE
    ======================= */
    $sql = "INSERT INTO vendor_invoice
        (vendor_id, product_name, billing_id, invoice_date, invoice_no,
         vehicle_number, terms_of_delivery, total_amount,
         tax_cgst_id, tax_sgst_id, cgst_amount, sgst_amount,
         grand_total, vendor_receipt)
        VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)";

$stmt = mysqli_prepare($conn, $sql);
        mysqli_stmt_bind_param(
        $stmt,
        "isissssdiiddds",
        $vendor_id,
        $product_name,
        $billing_id,
        $invoice_date,
        $invoice_no,
        $vehicle_number,
        $terms_of_delivery,
        $sub_total,
        $tax_cgst_id,
        $tax_sgst_id,
        $cgst_amount,
        $sgst_amount,
        $grand_total,
        $invoice_copy_path
    );

if (!mysqli_stmt_execute($stmt)) {
        throw new Exception(mysqli_stmt_error($stmt));
    }

$invoice_id = mysqli_insert_id($conn);
    mysqli_stmt_close($stmt);

/* =======================
       INSERT ITEMS
    ======================= */
    $item_sql = "INSERT INTO vendor_invoice_items
        (vendor_invoice_id, description, pack_type, qty, net_weight, rate, amount)
        VALUES (?,?,?,?,?,?,?)";

$item_stmt = mysqli_prepare($conn, $item_sql);

foreach ($items as $it) {
        mysqli_stmt_bind_param(
            $item_stmt,
            "issdddd",
            $invoice_id,
            $it['desc'],
            $it['pack'],
            $it['q'],
            $it['wt'],
            $it['r'],
            $it['amount']
        );
        mysqli_stmt_execute($item_stmt);
    }

mysqli_stmt_close($item_stmt);

/* =======================
       COMMIT
    ======================= */
    mysqli_commit($conn);

$_SESSION['success'] = "✅ Vendor Invoice saved successfully.";
    header("Location: vendor_invoice_list.php");
    exit;

} catch (Exception $e) {

mysqli_rollback($conn);

if (!empty($invoice_copy_path) && file_exists(__DIR__.'/'.$invoice_copy_path)) {
        unlink(__DIR__.'/'.$invoice_copy_path);
    }

$_SESSION['error'] = "❌ ".$e->getMessage();
    header("Location: vendor_invoice_add.php");
    exit;
}
?>