Zploit 0-Day Shell

:: Editing File: ticket_add.php

<?php 
ob_start();
include 'header.php';

$page_title = "Add Ticket";
$page_parent = "Tickets";
$page_parent_link = "ticket_list.php";

include 'breadcrumb.php';
include 'menu.php';

$message = "";

// ✅ Handle form submission
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$user_id = $_SESSION['user_id'] ?? 0;
    $subject = mysqli_real_escape_string($conn, $_POST['subject']);
    $message_text = mysqli_real_escape_string($conn, $_POST['message']);
    $created_at = date('Y-m-d H:i:s');

$attachment_path = "";

// ✅ Handle file upload
    if (!empty($_FILES['attachment']['name'])) {

$target_dir = "uploads/tickets/";
        if (!is_dir($target_dir)) {
            mkdir($target_dir, 0777, true);
        }

$file_name = basename($_FILES['attachment']['name']);
        $file_ext  = strtolower(pathinfo($file_name, PATHINFO_EXTENSION));

$allowed_ext = ['jpg','jpeg','png','pdf','doc','docx'];

if (!in_array($file_ext, $allowed_ext)) {
            $message = "Allowed files: JPG, PNG, PDF, DOC, DOCX";
        } else {

$new_file_name = time() . "_" . preg_replace("/[^a-zA-Z0-9_\.-]/", "_", $file_name);
            $target_file = $target_dir . $new_file_name;

if (move_uploaded_file($_FILES['attachment']['tmp_name'], $target_file)) {
                $attachment_path = $new_file_name;
            } else {
                $message = "Error uploading file.";
            }
        }
    }

if ($subject == '' || $message_text == '') {
        $message = "Subject and message are required.";
    }

// ✅ Insert into DB
    if ($message == '') {
        $sql = "INSERT INTO tickets (user_id, subject, message, attachment, created_at)
                VALUES ('$user_id', '$subject', '$message_text', '$attachment_path', '$created_at')";

if (mysqli_query($conn, $sql)) {
            header("Location: ticket_list.php?msg=Ticket submitted successfully");
            exit;
        } else {
            $message = "Database Error: " . mysqli_error($conn);
        }
    }
}
?>

<div class="page-body">
  <div class="container-fluid">
    <div class="row">
      <div class="col-sm-12">

<div class="card">
          <div class="card-header pb-0 card-no-border">
            <h2>Add Ticket</h2>
          </div>

<?php if ($message): ?>
              <div class="alert alert-danger"><?= $message; ?></div>
            <?php endif; ?>

<div class="col-md-6">
                  <label class="form-label">Subject</label>
                  <input type="text" name="subject" class="form-control" required>
                </div>

<div class="col-md-6">
                  <label class="form-label">Attachment (optional)</label>
                  <input type="file" name="attachment" class="form-control">
                </div>

<div class="col-md-12 mt-3">
                  <label class="form-label">Message</label>
                  <textarea name="message" class="form-control" rows="4" required></textarea>
                </div>

</div>

<br>
              <div class="text-start">
                <button type="submit" class="btn btn-success">Submit Ticket</button>
                <a href="ticket_list.php" class="btn btn-secondary">Cancel</a>
              </div>

</form>

</div>
        </div>

</div>
    </div>
  </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>