Zploit 0-Day Shell

:: Editing File: save_challan.php

<?php
include 'db.php';
include_once("session.php");

// If form not submitted, redirect
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    header('Location: add_challan.php');
    exit;
}

// ---------- 1️⃣ Sanitize and collect master challan fields ----------
$user_id        = (int)$_POST['user_id'];
$comment        = "delivery";
$challan_date   = mysqli_real_escape_string($conn, $_POST['challan_date']);
$challan_no     = mysqli_real_escape_string($conn, $_POST['challan_no']);
$farmer_id      = (int)$_POST['farmer_id'];
$farmer_contact = mysqli_real_escape_string($conn, $_POST['farmer_contact']);
$farmer_village = mysqli_real_escape_string($conn, $_POST['farmer_village']);
$farmer_location= mysqli_real_escape_string($conn, $_POST['farmer_location']);
$vendor_id      = (int)$_POST['vendor_id'];
$product_name    = mysqli_real_escape_string($conn, $_POST['product_name']);
$brand_desc     = mysqli_real_escape_string($conn, $_POST['brand_desc']); // rename if needed
$grand_total    = (float)$_POST['grand_total'];
$grand_wastage  = (float)$_POST['grand_wastage_kg'];
$supervisior    = mysqli_real_escape_string($conn, $_POST['supervisior_name']);
$vehicle_number = mysqli_real_escape_string($conn, $_POST['vehicle_number']);
$driver_number  = mysqli_real_escape_string($conn, $_POST['driver_number']);
$dispatch_time  = mysqli_real_escape_string($conn, $_POST['driver_number']); // rename field in form!
$cold_storage   = (int)$_POST['vendor_id']; // change name/id in form to cold_storage_id

$challan_receipt = null;

if (isset($_FILES['challan_receipt']) && $_FILES['challan_receipt']['error'] == 0) {
    $targetDir = "uploads/challan_receipts/";
    if (!is_dir($targetDir)) {
        mkdir($targetDir, 0777, true);
    }

$fileName = time() . "_" . basename($_FILES["challan_receipt"]["name"]);
    $targetFilePath = $targetDir . $fileName;

if (move_uploaded_file($_FILES["challan_receipt"]["tmp_name"], $targetFilePath)) {
        $challan_receipt = $fileName;
    }
}

// ---------- 2️⃣ Start transaction ----------
mysqli_begin_transaction($conn);

try {

// ---------- Insert master challan ----------
    $sql_master = "
        INSERT INTO challan
        (user_id, challan_date, challan_no, farmer_id, farmer_contact, farmer_village,
         farmer_location, vendor_id, product_name, brand_desc,
         grand_total_box, grand_wastage_kg,
         supervisior_name, vehicle_number, driver_number, dispatch_time, cold_storage_id, challan_receipt, created_at)
        VALUES
        ('$user_id','$challan_date','$challan_no','$farmer_id','$farmer_contact','$farmer_village',
         '$farmer_location','$vendor_id','$product_name','$brand_desc',
         '$grand_total','$grand_wastage',
         '$supervisior','$vehicle_number','$driver_number','$dispatch_time','$cold_storage','$challan_receipt', NOW())
    ";
    if (!mysqli_query($conn, $sql_master)) {
        throw new Exception("Master Challan insert error: ".mysqli_error($conn));
    }
    $challan_id = mysqli_insert_id($conn);
	$comment = $comment . "-" . $challan_id; 
    // ---------- 3️⃣ Insert Box Information ----------
    $box_4H  = (int)($_POST['4H'] ?? 0);
    $box_5H  = (int)($_POST['5H'] ?? 0);
    $box_6H  = (int)($_POST['6H'] ?? 0);
    $box_7H  = (int)($_POST['7H'] ?? 0);
    $box_8H  = (int)($_POST['8H'] ?? 0);
    $box_9H  = (int)($_POST['9H'] ?? 0);
    $box_10H = (int)($_POST['10H'] ?? 0);
    $box_CL  = (int)($_POST['CL'] ?? 0);
    $total_box = (int)($_POST['total_box'] ?? 0);

$sql_box = "
        INSERT INTO challen_box
        (challan_id, box_4H, box_5H, box_6H, box_7H, box_8H,
         box_9H, box_10H, box_CL, total_box,comment)
        VALUES
        ('$challan_id','$box_4H','$box_5H','$box_6H','$box_7H','$box_8H',
         '$box_9H','$box_10H','$box_CL','$total_box','$comment')
    ";
	
    if (!mysqli_query($conn, $sql_box)) {
        throw new Exception("Box info insert error: ".mysqli_error($conn));
    }

// ---------- 4️⃣ Insert each item row ----------
    if (!empty($_POST['item_desc'])) {
        $item_desc     = $_POST['item_desc'];
        $item_good     = $_POST['item_good'];
        $item_box      = $_POST['item_box'];
        $item_wastage  = $_POST['item_wastage'];

for ($i = 0; $i < count($item_desc); $i++) {
            $desc    = mysqli_real_escape_string($conn, $item_desc[$i]);
            $good    = mysqli_real_escape_string($conn, $item_good[$i]);
            $box     = (float)$item_box[$i];
            $wastage = (float)$item_wastage[$i];

if ($desc == '') continue; // skip empty rows

$sql_item = "
                INSERT INTO challen_items
                (challan_id, description, types_of_good, total_box, wastage_kg)
                VALUES
                ('$challan_id','$desc','$good','$box','$wastage')
            ";
            if (!mysqli_query($conn, $sql_item)) {
                throw new Exception("Items insert error: ".mysqli_error($conn));
            }
        }
    }

// ---------- 5️⃣ Commit transaction ----------
    mysqli_commit($conn);

// Optional: notification entry
    $msg  = "✅ Challan #$challan_no created successfully!";
    $type = "success";
    mysqli_query($conn, "INSERT INTO notifications (user_id, message, type)
                         VALUES ($user_id, '".mysqli_real_escape_string($conn,$msg)."', '$type')");

// Redirect / success message
    $_SESSION['success'] = "Challan Added Successfully!";
    header("Location: farmer_challen_list.php");
    exit;

} catch (Exception $e) {

// Rollback if any query fails
    mysqli_rollback($conn);

$_SESSION['error'] = "Error saving Challan: ".$e->getMessage();
    header("Location: farmer_challen_add.php");
    exit;
}
?>