Zploit 0-Day Shell

:: Editing File: stock_edit.php

<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);

include_once("session.php");
include("db.php");
include("header.php");

$id = (int)$_GET['id'];

/* ================= FETCH EXISTING STOCK ================= */

$sm = mysqli_fetch_assoc(mysqli_query($conn,"
    SELECT * FROM stock_movements WHERE id=$id
"));

$sbQ = mysqli_query($conn,"
    SELECT * FROM stock_movement_boxes WHERE movement_id=$id
");

$sb = mysqli_fetch_assoc($sbQ);
if (!$sb) {
    $sb = []; // prevent null error
}

if(!$sm){
    echo "<div class='alert alert-danger'>Invalid Stock ID</div>";
    exit;
}
?>

<main>
<div class="container-fluid">
<div class="row m-1">
<div class="col-12">
<h4 class="main-title">Edit Stock Movement</h4>
<ul class="app-line-breadcrumbs mb-3">
<li><a href="dashboard.php">Home</a></li>
<li><a href="stock_list.php">Stock List</a></li>
<li class="active"><a href="#">Edit Stock</a></li>
</ul>
</div>
</div>

<?php
if (!empty($_SESSION['success'])) {
    echo "<div class='alert alert-success'>{$_SESSION['success']}</div>";
    unset($_SESSION['success']);
}
if (!empty($_SESSION['error'])) {
    echo "<div class='alert alert-danger'>{$_SESSION['error']}</div>";
    unset($_SESSION['error']);
}
?>

<div class="col-md-3">
<label>Date *</label>
<input type="date" name="movement_date" class="form-control"
value="<?= $sm['movement_date']; ?>" required>
</div>

<div class="col-md-3">
<label>Stock Type *</label>
<select name="movement_type" class="form-control" required>
<option value="IN"  <?= $sm['movement_type']=='IN'?'selected':'' ?>>IN</option>
<option value="OUT" <?= $sm['movement_type']=='OUT'?'selected':'' ?>>OUT</option>
</select>
</div>

<div class="col-md-3">
<label>Vendor / Party</label>
<select name="vendor_id" class="form-control">
<option value="">Optional</option>
<?php
$q = mysqli_query($conn,"SELECT id,name FROM party ORDER BY name");
while($r=mysqli_fetch_assoc($q)){
    $sel = ($sm['vendor_id']==$r['id'])?'selected':'';
    echo "<option value='{$r['id']}' $sel>{$r['name']}</option>";
}
?>
</select>
</div>

<div class="col-md-3">
<label>Cold Storage</label>
<select name="cold_storage_id" class="form-control">
<option value="">Optional</option>
<?php
$q = mysqli_query($conn,"SELECT id,company_name FROM cold_storage ORDER BY company_name");
while($r=mysqli_fetch_assoc($q)){
    $sel = ($sm['cold_storage_id']==$r['id'])?'selected':'';
    echo "<option value='{$r['id']}' $sel>{$r['company_name']}</option>";
}
?>
</select>
</div>

<div class="col-md-6">
<label>Product *</label>
<select name="product_id" id="product_id" class="form-control" required>
<?php
$q = mysqli_query($conn,"
SELECT id, product_name 
FROM packaging_materials 
WHERE status=1 AND category_id='3'
ORDER BY product_name
");
while($r=mysqli_fetch_assoc($q)){
    $sel = ($sm['product_id']==$r['id'])?'selected':'';
    echo "<option value='{$r['id']}' $sel>{$r['product_name']}</option>";
}
?>
</select>
</div>

<div class="col-md-6">
<label>Brand / Description</label>
<input type="text" name="brand_desc" class="form-control"
value="<?= $sm['brand_desc']; ?>">
</div>

<hr>

<div class="col-md-4">
<label>Vehicle No</label>
<input type="text" name="vehicle_number" class="form-control"
value="<?= $sm['vehicle_number']; ?>">
</div>

<div class="col-md-4">
<label>Container No</label>
<input type="text" name="container_no" class="form-control"
value="<?= $sm['container_no']; ?>">
</div>

<div class="col-md-4">
<label>Dispatch Time</label>
<input type="datetime-local" name="dispatch_time" class="form-control"
value="<?= $sm['dispatch_time']; ?>">
</div>

<hr>

<?php
$catQ = mysqli_query($conn,"SELECT category_name FROM box_category WHERE status=1");
while($c=mysqli_fetch_assoc($catQ)){
    $key = "box_".preg_replace("/[^A-Za-z0-9]/","",$c['category_name']);
    $val = isset($sb[$key]) ? (int)$sb[$key] : 0;
    echo "
    <div class='col-md-2'>
        <label>{$c['category_name']}</label>
        <input type='number' name='$key' class='form-control box-input'
               value='$val' min='0'>
        <small class='text-muted'>
            Available: <span id='{$key}_avail'>0</span>
        </small>
    </div>";
}
?>

<div class="col-md-2">
<label>Total Boxes</label>
<input type="number" id="total_boxes" class="form-control" readonly
value="<?= $sm['total_box']; ?>">
<small class="text-muted">
Available: <span id="total_box_avail">0</span>
</small>
</div>

<div class="col-md-12">
<label>Remark</label>
<textarea name="remark" class="form-control"><?= $sm['remark']; ?></textarea>
</div>

<div class="col-12">
<button class="btn btn-primary">Update Stock</button>
<a href="stock_list.php" class="btn btn-secondary">Back</a>
</div>

</form>
</div>
</div>
</div>
</main>

<?php include("footer.php"); ?>

// load available stock excluding current record
document.getElementById("product_id").addEventListener("change",loadStock);
window.onload = loadStock;

function loadStock(){
    let pid = document.getElementById("product_id").value;
    if(!pid) return;

fetch("ajax_get_box_stock.php?product_id="+pid+"&exclude_id=<?= $id ?>")
    .then(r=>r.json())
    .then(d=>{
        for(let k in d){
            let el = document.getElementById(k+"_avail");
            if(el) el.innerText = d[k];
        }
        document.getElementById("total_box_avail").innerText = d.total_box;
    });
}
</script>