Zploit 0-Day Shell

:: Editing File: profile-edit.php

<?php

include 'header.php';

// ✅ Set breadcrumb variables
$page_title = "Edit Profile";
//$page_parent = "Dashboard";

include 'breadcrumb.php';
include 'menu.php';

$user_id = $_SESSION['user_id'];
$message = "";

// ✅ Fetch current user data
 $query = "SELECT * FROM users WHERE id = '$user_id'";
$result = mysqli_query($conn, $query);

if (mysqli_num_rows($result) === 0) {
    header("Location: dashboard.php?msg=User not found");
    exit;
}
$user = mysqli_fetch_assoc($result);

// ✅ Handle form submission
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $name = mysqli_real_escape_string($conn, $_POST['name']);
    $email = mysqli_real_escape_string($conn, $_POST['email']);
    $mobile = mysqli_real_escape_string($conn, $_POST['mobile']);
    $occupation = mysqli_real_escape_string($conn, $_POST['occupation']);
    $role = mysqli_real_escape_string($conn, $_POST['role']);
    $about_me = mysqli_real_escape_string($conn, $_POST['about_me']);
    $location = mysqli_real_escape_string($conn, $_POST['location']);
    $status = mysqli_real_escape_string($conn, $_POST['status']);

// ✅ Handle profile picture upload
    $pic = $user['pic'];
    if (!empty($_FILES['pic']['name'])) {
        $target_dir = "uploads/profile/";
        if (!is_dir($target_dir)) mkdir($target_dir, 0777, true);

$file_name = time() . "_" . basename($_FILES['pic']['name']);
        $target_file = $target_dir . $file_name;

if (move_uploaded_file($_FILES['pic']['tmp_name'], $target_file)) {
            $pic = $file_name;
        }
    }

// ✅ Handle password update (optional)
    $password_sql = "";
    if (!empty($_POST['password'])) {
        $password = password_hash($_POST['password'], PASSWORD_BCRYPT);
        $password_sql = ", password = '$password'";
    }

// ✅ Update query
    $sql = "UPDATE users SET 
                name = '$name',
                email = '$email',
                mobile = '$mobile',
                occupation = '$occupation',
                role = '$role',
                about_me = '$about_me',
                location = '$location',
                status = '$status',
                pic = '$pic'
                $password_sql
            WHERE id = '$user_id'";

if (mysqli_query($conn, $sql)) {
        $message = "<div class='alert alert-success'>Profile updated successfully!</div>";
        $query = "SELECT * FROM users WHERE id = '$user_id'";
        $user = mysqli_fetch_assoc(mysqli_query($conn, $query)); // refresh user data
    } else {
        $message = "<div class='alert alert-danger'>Error: " . mysqli_error($conn) . "</div>";
    }
}

<div class="card-header pb-0 card-no-border">
                        <h2>Edit Profile</h2>
                    </div>

<form method="POST" enctype="multipart/form-data">
                            <div class="row">
       
                                <div class="col-md-12">
                                    <div class="row">
                                        <div class="col-md-6">
                                            <label class="form-label">Name</label>
                                            <input type="text" name="name" class="form-control" value="<?= htmlspecialchars($user['name']) ?>" required>
                                        </div>

<div class="col-md-6">
                                            <label class="form-label">Email</label>
                                            <input type="email" name="email" class="form-control" value="<?= htmlspecialchars($user['email']) ?>" required>
                                        </div>

<div class="col-md-6">
                                            <label class="form-label">Mobile</label>
                                            <input type="text" name="mobile" class="form-control" value="<?= htmlspecialchars($user['mobile']) ?>">
                                        </div>

<div class="col-md-6">
                                            <label class="form-label">Occupation</label>
                                            <input type="text" name="occupation" class="form-control" value="<?= htmlspecialchars($user['occupation']) ?>">
                                        </div>

<div class="col-md-6">
                                            <label class="form-label">Role</label>
                                            <select name="role" class="form-select">
                                                <option value="admin" <?= ($user['role'] == 'admin') ? 'selected' : '' ?>>Admin</option>
                                                <option value="user" <?= ($user['role'] == 'user') ? 'selected' : '' ?>>User</option>
                                            </select>
                                        </div>

<div class="col-md-6">
                                            <label class="form-label">Location</label>
                                            <input type="text" name="location" class="form-control" value="<?php  echo $user['location']; ?>">
                                        </div>
									</div>
									<div class="row">

<div class="col-md-4 mb-4">
												
												<label class="form-label">User Profile Pic</label>
												<input type="file" name="pic" class="form-control">
												
												
											</div>
											
											<div class="col-md-2 mb-4">
												
												<?php if (!empty($user['pic'])): ?>
													<img src="uploads/profile/<?= htmlspecialchars($user['pic']) ?>" alt="Profile Picture" class="rounded-circle" width="100" height="100">
												<?php else: ?>
													<img src="uploads/profile/default-avatar.png" alt="Default Avatar" class="rounded-circle" width="100" height="100">
												<?php endif; ?>
												
											</div>
										
										 <div class="col-md-6 mt-3">
                                            <label class="form-label">Status</label>
                                            <select name="status" class="form-select">
                                                <option value="active" <?= ($user['status'] == 'active') ? 'selected' : '' ?>>Active</option>
                                                <option value="inactive" <?= ($user['status'] == 'inactive') ? 'selected' : '' ?>>Inactive</option>
                                            </select>
                                        </div>
										
                                    </div>
                                </div>
                            </div>

<br>
                            <div class="text-start">
                                <button type="submit" class="btn btn-success">Update Profile</button>
                                <a href="dashboard.php" class="btn btn-secondary">Cancel</a>
                            </div>
                        </form>

</div>
                </div>
            </div>
        </div>
    </div>
</div>

<?php include 'footer.php'; ?>