Zploit 0-Day Shell

:: Editing File: save_stock.php

<?php
include_once("session.php");
include("db.php");

// Only allow POST
if ($_SERVER["REQUEST_METHOD"] != "POST") {
    $_SESSION['error'] = "Invalid request!";
    header("Location: add_stock.php");
    exit;
}

mysqli_begin_transaction($conn);
$success = true;

try {

// -------------------------------------------------------
    // 1. SANITIZE MAIN FIELDS
    // -------------------------------------------------------
    $movement_date      = mysqli_real_escape_string($conn, $_POST['movement_date']);
    $movement_type   = mysqli_real_escape_string($conn, $_POST['movement_type']);
    $vendor_id       = (int) ($_POST['vendor_id'] ?? 0);
    $product_name    = mysqli_real_escape_string($conn, $_POST['product_name']);
    $brand_desc      = mysqli_real_escape_string($conn, $_POST['brand_desc']);
    $total_box       = (int) ($_POST['total_box'] ?? 0);
    $cold_storage_id = (int) ($_POST['cold_storage_id'] ?? 0);
    $remark          = mysqli_real_escape_string($conn, $_POST['remark']);

// -------------------------------------------------------
    // 2. INSERT INTO stock_movements
    // -------------------------------------------------------
    $sql_movement = "
        INSERT INTO stock_movements 
        (movement_date, movement_type, vendor_id, product_name, brand_desc, total_box, cold_storage_id, remark)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?)
    ";

$stmt1 = mysqli_prepare($conn, $sql_movement);
    if (!$stmt1) throw new Exception("Movement prepare failed: " . mysqli_error($conn));

mysqli_stmt_bind_param(
        $stmt1,
        "ssissiis",
        $movement_date,
        $movement_type,
        $vendor_id,
        $product_name,
        $brand_desc,
        $total_box,
        $cold_storage_id,
        $remark
    );

if (!mysqli_stmt_execute($stmt1)) {
        throw new Exception("Movement insert failed: " . mysqli_stmt_error($stmt1));
    }

$movement_id = mysqli_insert_id($conn);
    mysqli_stmt_close($stmt1);

// -------------------------------------------------------
    // 3. INSERT INTO stock_movement_boxes (Dynamic)
    // -------------------------------------------------------
    $query = "SELECT category_name FROM box_category WHERE status = 1 ORDER BY id ASC";
    $cat_result = mysqli_query($conn, $query);

if (!$cat_result) {
        throw new Exception("Failed to load box categories.");
    }

while ($row = mysqli_fetch_assoc($cat_result)) {

$category_name = $row['category_name'];
        $input_key = "box_" . preg_replace("/[^A-Za-z0-9]/", "", $category_name);

$box_count = (int) ($_POST[$input_key] ?? 0);

$sql_box = "
            INSERT INTO stock_movement_boxes (movement_id, category_name, box_count)
            VALUES (?, ?, ?)
        ";

$stmt2 = mysqli_prepare($conn, $sql_box);
        if (!$stmt2) throw new Exception("Box prepare failed: " . mysqli_error($conn));

mysqli_stmt_bind_param($stmt2, "isi", $movement_id, $category_name, $box_count);

if (!mysqli_stmt_execute($stmt2)) {
            throw new Exception("Box insert error: " . mysqli_stmt_error($stmt2));
        }

mysqli_stmt_close($stmt2);
    }

// -------------------------------------------------------
    // Success → Commit
    // -------------------------------------------------------

mysqli_commit($conn);
    $_SESSION['success'] = "Stock movement saved successfully!";

} catch (Exception $e) {

// Rollback on error
    mysqli_rollback($conn);
    $_SESSION['error'] = "Error saving stock movement: " . $e->getMessage();
}

// Redirect
header("Location: add_stock.php");
exit;
?>