Zploit 0-Day Shell

:: Editing File: profile.php

<?php include("header.php"); ?>	
		  
		  
		 <main>
			<div class="container-fluid">

<div class="row m-1">
					<div class="col-12 ">
						<h4 class="main-title">User Profile</h4>
						<ul class="app-line-breadcrumbs mb-3">
							<li class="">
								<a class="f-s-14 f-w-500" href="dashboard.php">
								  <span>
									<i class="ph-duotone  ph-bank f-s-16"></i> Home
								  </span>
								</a>
							</li>
							<li class="active">
								<a class="f-s-14 f-w-500" href="#"> User Profile</a>
							</li>
						</ul>
					</div>
				</div>
				
				
				<?php if (isset($_POST['id'])) {
									
								//print_r($_POST);
								
					$id       = $_POST['id'];
					$username = mysqli_real_escape_string($conn, $_POST['username']);
					$password = mysqli_real_escape_string($conn, $_POST['password']);
					$role     = mysqli_real_escape_string($conn, $_POST['role']);

// Handle file upload
					$image_sql = "";
					if (!empty($_FILES['image']['name'])) {
						$target_dir = "uploads/";
						if (!is_dir($target_dir)) mkdir($target_dir, 0777, true);

$image_name = time() . "_" . basename($_FILES['image']['name']);
						$target_file = $target_dir . $image_name;

if (move_uploaded_file($_FILES['image']['tmp_name'], $target_file)) {
							$image_sql = ", user_image='uploads/$image_name'";
						}
					}

// Update user
					 $sql = "UPDATE users SET username='$username', role='$role', password='$password' $image_sql WHERE id=$id";

if (mysqli_query($conn, $sql)) {
						$_SESSION['user_name'] = $username;
						$_SESSION['user_role'] = $role;
						$_SESSION['success'] = "Profile updated successfully!";
						
						 $msg = "✅ User profile updated successfully!";
						 $type = "success";
						 
						 mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$id', '$msg', '$type')");
							
					} else {
						$_SESSION['error'] = "Error updating profile!";
						
							$msg = "❌ Database error while updating Profile!";
							$type = "error";
							mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$id', '$msg', '$type')");		
					}
					}
				?>
								
				<div class="row">
                    
					<div class="col-12">
						<div class="card">
							<div class="card-body">
								<?php 
									// Fetch current user details
									
									//echo $user_id;
									$user_id = $_SESSION['user_id'];
									$sql = "SELECT * FROM users WHERE id = $user_id LIMIT 1";
									$result = mysqli_query($conn, $sql);
									$user = mysqli_fetch_assoc($result);
									
									//print_r($user);
									
									// Success / Error message (optional)
									if (isset($_SESSION['success'])) {
										echo '<div class="alert alert-success" id="autoAlert" role="alert">'.$_SESSION['success'].'</div>';
										unset($_SESSION['success']);
									}
									if (isset($_SESSION['error'])) {
										echo '<div class="alert alert-danger" id="autoAlert" role="alert">'.$_SESSION['error'].'</div>';
										unset($_SESSION['error']);
									}
		
								?>
								
								
						
								<form class="row g-3 app-form" id="form-validation" method="post" enctype="multipart/form-data" action="">
									<input type="hidden" name="id" value="<?php echo $user['id']; ?>">
									<div class="col-md-6">
										<label class="form-label" for="userName">User Name</label>
										<input class="form-control" id="userName" name="username" type="text" value="<?php echo $user['username']; ?>">
										<div class="mt-1">
											<span class="text-danger" id="userNameError"></span>
										</div>
									</div>
									<div class="col-md-6">
										<label class="form-label" for="email">Password</label>
										<input class="form-control" id="email" type="text"  name="password" value="<?php echo $user['password']; ?>">
										<div class="mt-1">
											<span class="text-danger" id="emailError"></span>
										</div>
									</div>
									<div class="col-md-6">
										<label class="form-label">Role</label>
										 <select class="form-control" name="role" required>
											<option value="admin"  <?php if ($user['role'] == 'admin')  echo "selected"; ?>>Admin</option>
											<option value="vendor" <?php if ($user['role'] == 'vendor') echo "selected"; ?>>Vendor</option>
											<option value="farmer" <?php if ($user['role'] == 'farmer') echo "selected"; ?>>Farmer</option>
											<option value="manager"<?php if ($user['role'] == 'manager')echo "selected"; ?>>Manager</option>
											<option value="user"   <?php if ($user['role'] == 'user')   echo "selected"; ?>>User</option>
										</select>
									</div>
									
									<div class="col-md-6">
										 <label class="form-label">Profile Picture</label>
										 <input type="file" class="form-control " name="image" >
										   <?php if (!empty($user['user_image'])): ?>
											<img src="<?php echo $user['user_image']; ?>" class="mt-2" width="50" height="50" style="border-radius:50%;object-fit:cover;">
										<?php else: ?>
											<img src="assets/images/avatar/woman.jpg" class="mt-2" width="50" height="50" style="border-radius:50%;object-fit:cover;">
										<?php endif; ?>
									</div>
									
									<div class="col-12">
										<button type="submit" class="btn btn-primary" type="submit">Submit</button>
									</div>
										
								</form>
								
							</div>
						</div>
					</div>
				</div>
			</div>	
		</main>
	</div>	
</div>

<?php include("footer.php"); ?>