Zploit 0-Day Shell

:: Editing File: print_po_invoice.php

<?php
// Include your database connection and Composer's autoloader
include("db.php");
require_once __DIR__ . '/vendor/autoload.php';

// Check if an ID is provided in the URL and perform validation
$invoice_id = (int)($_GET['id'] ?? 0);

if ($invoice_id === 0) {
    die("Error: Vendor Invoice ID is missing or invalid.");
}

// ----------------------------------------
// --- 1. Fetch Master Invoice Data securely using a prepared statement ---
// ----------------------------------------
$sql_invoice = "
    SELECT 
        vi.*, 
        v.name AS vendor_name, 
        v.address AS vendor_address, 
        v.phone AS vendor_contact,
        b.company_name AS billing_name
    FROM vendor_invoice AS vi
    JOIN vendors AS v ON vi.vendor_id = v.id
    JOIN billing AS b ON vi.billing_id = b.id
    WHERE vi.id = ?
";

$stmt_invoice = mysqli_prepare($conn, $sql_invoice);
if (!$stmt_invoice) {
    die("SQL prepare error for master invoice: " . mysqli_error($conn));
}

mysqli_stmt_bind_param($stmt_invoice, "i", $invoice_id);
mysqli_stmt_execute($stmt_invoice);
$result_invoice = mysqli_stmt_get_result($stmt_invoice);

if (mysqli_num_rows($result_invoice) == 0) {
    die("Error: No invoice found with this ID.");
}
$invoice = mysqli_fetch_assoc($result_invoice);
mysqli_stmt_close($stmt_invoice);

// ----------------------------------------
// --- 2. Fetch Invoice Items Data securely ---
// ----------------------------------------
$sql_items = "SELECT * FROM vendor_invoice_items WHERE vendor_invoice_id = ?";

$stmt_items = mysqli_prepare($conn, $sql_items);
if (!$stmt_items) {
    die("SQL prepare error for invoice items: " . mysqli_error($conn));
}

mysqli_stmt_bind_param($stmt_items, "i", $invoice_id);
mysqli_stmt_execute($stmt_items);
$result_items = mysqli_stmt_get_result($stmt_items);
mysqli_stmt_close($stmt_items);

// ----------------------------------------
// --- 3. Start building the HTML for the PDF using an output buffer ---
// ----------------------------------------
ob_start();
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Invoice - #<?php echo htmlspecialchars($invoice['invoice_no']); ?></title>
    <style>
        body { font-family: Calibri, sans-serif; font-size: 11px; color: #000; }
        .page-container { border: 1px solid #000; padding: 5px; }
        h2 { font-size: 16px; margin: 0; padding: 0; }
        table { width: 100%; border-collapse: collapse; }
        
        /* Header section */
        .header-table td { vertical-align: top; padding: 5px; }
        .vendor-details { text-align: left; border: 1px solid #000; }
        .invoice-meta { text-align: right; border: 1px solid #000; }
        .meta-box {display: inline-block; text-align: left; }
        .meta-box td { padding: 4px 8px; }
        .meta-box .label { font-weight: bold; }
        
        /* Billing section */
        .billing-details { padding: 10px 5px; }

/* Items table */
        .items-table { margin-top: 10px; }
        .items-table th, .items-table td { border: 1px solid #000; padding: 5px; }
        .items-table thead th { font-weight: bold; text-align: center; }
        .items-table td { vertical-align: top; }
        .items-table .col-amount, .items-table .col-rate, .items-table .col-qty, .items-table .col-netwt { text-align: right; }
        .items-table .col-desc { text-align: left; }
        .items-table .col-sno { text-align: center; }
        
        /* Footer section */
        .footer-table { margin-top: 10px; }
        .footer-table td { vertical-align: bottom; }
        .grand-total-cell { text-align: right; }
        .grand-total-box { border: 1px solid #000; display: inline-block; padding: 5px; }
        .grand-total-box td { padding: 2px 8px; }
        .grand-total-box .label { font-weight: bold; }
        .signature-section { padding-top: 40px; font-weight: bold; }

</style>
</head>
<body>
    <div class="page-container">
        <h3 style="text-align: center; border-bottom: 2px solid #000; padding-bottom: 5px;">INVOICE</h3>

<table class="header-table">
            <tr>
                <td class="" style="text-align: center; border-bottom: 1px solid #000; padding-bottom: 5px;">
                    <center><h1 ><i><?php echo htmlspecialchars(strtoupper($invoice['vendor_name'])); ?></i></h1></center>
                </td>
			</tr>
		</table>
		<table class="header-table">
            <tr>
				<td class="vendor-details" style="width: 70%">
				
					<p style="margin: 5px 0;"><?php echo nl2br(htmlspecialchars($invoice['vendor_address'])); ?></p>
					<p style="margin: 5px 0;">PHONE NO: <?php echo htmlspecialchars($invoice['vendor_contact']); ?></p>
				</td>
				
				
                <td class="invoice-meta" style="width: 30%;">
                    <table class="meta-box">
                        <tr>
                            <td class="label">Invoice Date:</td>
                            <td><?php echo date("d-m-Y", strtotime($invoice['invoice_date'])); ?></td>
                        </tr>
                        <tr>
                            <td class="label">Invoice No:</td>
                            <td><?php echo htmlspecialchars($invoice['invoice_no']); ?></td>
                        </tr>
                         <tr>
                            <td class="label">Vehicle No:</td>
                            <td><?php echo htmlspecialchars($invoice['vehicle_number']); ?></td>
                        </tr>
                        
                    </table>
                </td>
            </tr>
        </table>
		
		<table class="header-table">
            <tr>
				<td class="vendor-details" style="width: 70%">
					
					<p style="margin: 5px 0;">Bill To,<br><?php echo nl2br(htmlspecialchars($invoice['billing_name'])); ?></p>
					
				</td>
				
				<td class="vendor-details" style="width: 30%">
					
					<p style="margin: 5px 0;">Terms Of Delivery<br><?php echo nl2br(htmlspecialchars($invoice['terms_of_delivery'])); ?></p>
					
				</td>
				
               
            </tr>
        </table>

<table class="items-table">
            <thead>
                <tr>
                    <th style="width:5%;">Sr. no</th>
                    <th style="width:35%;">Description</th>
                    <th>Pack Type</th>
                    <th>Box Quantity</th>
                    <th>Net. Weight</th>
                    <th>Unit</th>
                    <th>Rate</th>
                    <th style="width:15%;">Amount</th>
                </tr>
            </thead>
            <tbody>
                <?php
                $sn = 1;
                $rowCount = mysqli_num_rows($result_items);
                $emptyRows = 3 - $rowCount; // Calculate how many empty rows to add for consistent height

if ($rowCount > 0) {
                    while ($item = mysqli_fetch_assoc($result_items)) { ?>
                        <tr>
                            <td class="col-sno"><?php echo $sn++; ?></td>
                            <td class="col-desc"><?php echo htmlspecialchars($item['description']); ?></td>
                            <td class="col-sno"><?php echo htmlspecialchars($item['pack_type']); ?></td>
                            <td class="col-qty"><?php echo number_format($item['qty'], 2); ?></td>
                            <td class="col-netwt"><?php echo number_format($item['net_weight'], 2); ?></td>
                            <td class="col-sno"><?php echo htmlspecialchars($item['unit']); ?></td>
                            <td class="col-rate"><?php echo number_format($item['rate'], 2); ?></td>
                            <td class="col-amount"><?php echo number_format($item['amount'], 2); ?></td>
                        </tr>
                <?php }
                }
                
                // Add empty rows to maintain a consistent table height
                for ($i = 0; $i < $emptyRows; $i++) {
                    echo '<tr><td>&nbsp;</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr>';
                }
                ?>
            </tbody>
        </table>

<table class="footer-table">
            <tr>
                <td style="width: 60%;" class="signature-section">
                    M/S <?php echo htmlspecialchars(strtoupper($invoice['vendor_name'])); ?>
                    <br><br><br>
                    Authorised Signatory
                </td>
                <td style="width: 40%;" class="grand-total-cell">
                     <table class="grand-total-box">
                        <tr>
                            <td class="label">Grand Total</td>
                            <td><?php echo number_format($invoice['grand_total'], 2); ?></td>
                        </tr>
                    </table>
                </td>
            </tr>
        </table>
    </div>
</body>
</html>
<?php
// --- 4. Get the captured HTML content and generate the PDF ---
$invoiceHTML = ob_get_clean();

// Create a new mPDF instance with default settings
$mpdf = new \Mpdf\Mpdf([
    'mode' => 'utf-8',
    'format' => 'A4',
    'margin_left' => 10,
    'margin_right' => 10,
    'margin_top' => 10,
    'margin_bottom' => 10,
]);

// Write the HTML content to the PDF
$mpdf->WriteHTML($invoiceHTML);

// Output the PDF to the browser for inline display ('I')
// Use 'D' to force a download
$mpdf->Output('Invoice-' . $invoice['invoice_no'] . '.pdf', 'I');