Zploit 0-Day Shell

:: Editing File: vcard_company_edit.php

<?php
ob_start();
include 'header.php';

$page_title = "Edit VCard Company";
include 'breadcrumb.php';
include 'menu.php';

/* ===============================
   PATH CONFIG
   =============================== */
define('COMPANY_UPLOAD_PATH', $_SERVER['DOCUMENT_ROOT'].'/kreative_crm/uploads/company/');

/* ===============================
   VALIDATE ID
   =============================== */
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    header("Location: vcard_company_list.php?msg=Invalid Company ID");
    exit;
}

$id = intval($_GET['id']);

/* ===============================
   FETCH COMPANY
   =============================== */
$q = mysqli_query($conn,"SELECT * FROM vcard_company WHERE id='$id'");
if (!$q || mysqli_num_rows($q) === 0) {
    header("Location: vcard_company_list.php?msg=Company Not Found");
    exit;
}
$row = mysqli_fetch_assoc($q);

/* ===============================
   ENSURE UPLOAD DIRS
   =============================== */
if (!is_dir(COMPANY_UPLOAD_PATH.'logo/')) {
    mkdir(COMPANY_UPLOAD_PATH.'logo/', 0777, true);
}
if (!is_dir(COMPANY_UPLOAD_PATH.'banner/')) {
    mkdir(COMPANY_UPLOAD_PATH.'banner/', 0777, true);
}

/* ===============================
   FORM SUBMIT
   =============================== */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$name        = mysqli_real_escape_string($conn, $_POST['name']);
    $about       = mysqli_real_escape_string($conn, $_POST['about']);
    $address     = mysqli_real_escape_string($conn, $_POST['address']);
    $map_iframe  = mysqli_real_escape_string($conn, $_POST['map_iframe']);
    $status      = isset($_POST['status']) ? 1 : 0;

$logo   = $row['logo'];
    $banner = $row['banner_image'];

/* ===============================
       LOGO UPLOAD
       =============================== */
    if (!empty($_FILES['logo']['name'])) {

if ($logo && file_exists(COMPANY_UPLOAD_PATH.'logo/'.$logo)) {
            unlink(COMPANY_UPLOAD_PATH.'logo/'.$logo);
        }

$ext = strtolower(pathinfo($_FILES['logo']['name'], PATHINFO_EXTENSION));
        $logo = time().'_logo_'.uniqid().'.'.$ext;

move_uploaded_file(
            $_FILES['logo']['tmp_name'],
            COMPANY_UPLOAD_PATH.'logo/'.$logo
        );
    }

/* ===============================
       BANNER UPLOAD
       =============================== */
    if (!empty($_FILES['banner_image']['name'])) {

if ($banner && file_exists(COMPANY_UPLOAD_PATH.'banner/'.$banner)) {
            unlink(COMPANY_UPLOAD_PATH.'banner/'.$banner);
        }

$ext = strtolower(pathinfo($_FILES['banner_image']['name'], PATHINFO_EXTENSION));
        $banner = time().'_banner_'.uniqid().'.'.$ext;

move_uploaded_file(
            $_FILES['banner_image']['tmp_name'],
            COMPANY_UPLOAD_PATH.'banner/'.$banner
        );
    }

/* ===============================
       UPDATE DATABASE
       =============================== */
    mysqli_query($conn,"
        UPDATE vcard_company SET
            name = '$name',
            about = '$about',
            banner_image = ".($banner ? "'$banner'" : "NULL").",
            logo = ".($logo ? "'$logo'" : "NULL").",
            address = '$address',
            map_iframe = '$map_iframe',
            status = '$status',
            updated_at = NOW()
        WHERE id = '$id'
    ");

header("Location: vcard_company_list.php?msg=Company Updated Successfully");
    exit;
}
?>

<div class="page-body">
<div class="container-fluid">
<div class="card">
<div class="card-body">

<div class="col-md-6 mb-3">
<label class="form-label">Company Name *</label>
<input type="text" name="name" class="form-control"
       value="<?= htmlspecialchars($row['name']); ?>" required>
</div>

<div class="col-md-6 mb-3">
<label class="form-label mt-3">About Company</label>
<textarea name="about" class="form-control" rows="4"><?= htmlspecialchars($row['about']); ?></textarea>
</div>

<div class="col-md-6 mb-3">
<label class="form-label mt-3">Company Logo</label>
<input type="file" name="logo" class="form-control">
<?php if ($row['logo']): ?>
    <div class="mt-2">
        <img src="uploads/company/logo/<?= $row['logo']; ?>"
             style="height:50px;border-radius:6px;">
    </div>
<?php endif; ?>
</div>

<div class="col-md-6 mb-3">
<label class="form-label mt-3">Company Banner</label>
<input type="file" name="banner_image" class="form-control">
<?php if ($row['banner_image']): ?>
    <div class="mt-2">
        <img src="uploads/company/banner/<?= $row['banner_image']; ?>"
             style="height:50px;border-radius:6px;">
    </div>
<?php endif; ?>
</div>

<div class="col-md-6 mb-3">
<label class="form-label mt-3">Address</label>
<textarea name="address" class="form-control" rows="3"><?= htmlspecialchars($row['address']); ?></textarea>
</div>

<div class="col-md-6 mb-3">
<label class="form-label mt-3">Map Iframe</label>
<textarea name="map_iframe" class="form-control" rows="3"><?= htmlspecialchars($row['map_iframe']); ?></textarea>
</div>

<div class="col-md-6 mb-3">
<label class="form-label mt-3">
    <input type="checkbox" name="status" <?= ($row['status']==1)?'checked':''; ?>> Active
</label>
</div>
<br><br>
<div class="col-md-12 mb-3">
<button type="submit" class="btn btn-success">Update Company</button>
<a href="vcard_company_list.php" class="btn btn-secondary">Cancel</a>
</div></div>
</form>

</div>
</div>
</div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>