Zploit 0-Day Shell

:: Editing File: packaging_stock_delete.php

<?php
ob_start();
error_reporting(E_ALL);
ini_set('display_errors', 1);

include_once("session.php");
include("db.php");

$user_id = $_SESSION['user_id'] ?? 0;

if (!isset($_GET['id']) || (int)$_GET['id'] <= 0) {
    $_SESSION['error'] = "❌ Invalid stock ID!";
    header("Location: packaging_stock_list.php");
    exit;
}

$stock_id = (int)$_GET['id'];

/* ---------- FETCH STOCK ROW ---------- */
$stock = mysqli_fetch_assoc(mysqli_query($conn,"
    SELECT *
    FROM packaging_stock
    WHERE id = '$stock_id'
"));

if (!$stock) {
    $_SESSION['error'] = "❌ Stock record not found!";
    header("Location: packaging_stock_list.php");
    exit;
}

$product_id = $stock['product_id'];
$qty        = (float)$stock['quantity'];
$type       = $stock['stock_type'];

mysqli_begin_transaction($conn);

try {

/* ---------- FIND PREVIOUS AVAILABLE STOCK ---------- */
    $prev = mysqli_fetch_assoc(mysqli_query($conn,"
        SELECT available_stock
        FROM packaging_stock
        WHERE product_id = '$product_id'
          AND status = 1
          AND id < '$stock_id'
        ORDER BY id DESC
        LIMIT 1
    "));

$base_stock = $prev ? (float)$prev['available_stock'] : 0;

/* ---------- DELETE CURRENT ROW ---------- */
    mysqli_query($conn,"
        DELETE FROM packaging_stock
        WHERE id = '$stock_id'
    ");

if (mysqli_affected_rows($conn) === 0) {
        throw new Exception("Delete failed");
    }

/* ---------- FIX ALL NEXT ROWS ---------- */
    $next_q = mysqli_query($conn,"
        SELECT id, stock_type, quantity
        FROM packaging_stock
        WHERE product_id = '$product_id'
          AND status = 1
          AND id > '$stock_id'
        ORDER BY id ASC
    ");

while ($row = mysqli_fetch_assoc($next_q)) {

if ($row['stock_type'] === 'IN') {
            $base_stock += (float)$row['quantity'];
        } else {
            $base_stock -= (float)$row['quantity'];
        }

mysqli_query($conn,"
            UPDATE packaging_stock
            SET available_stock = '$base_stock'
            WHERE id = '{$row['id']}'
        ");
    }

mysqli_commit($conn);

$_SESSION['success'] = "✅ Stock deleted successfully!";

mysqli_query($conn,"
        INSERT INTO notifications (user_id, message, type)
        VALUES ('$user_id','Stock entry deleted','success')
    ");

} catch (Exception $e) {

mysqli_rollback($conn);

$_SESSION['error'] = "❌ Failed to delete stock!";

mysqli_query($conn,"
        INSERT INTO notifications (user_id, message, type)
        VALUES ('$user_id','Stock delete failed','error')
    ");
}

header("Location: packaging_stock_list.php");
exit;