Zploit 0-Day Shell

:: Editing File: vcard_add.php

<?php
ob_start();
include 'header.php';

$page_title = "Add VCard";
$page_parent = "VCards";
$page_parent_link = "vcard_list.php";

include 'breadcrumb.php';
include 'menu.php';

$message = "";

/* ===============================
   PATH CONFIG (VERY IMPORTANT)
   =============================== */

// Filesystem path (for upload)
define('VCARD_UPLOAD_PATH', $_SERVER['DOCUMENT_ROOT'] . '/kreativecrm/uploads/vcard/');

// Public URL (for image display later)
define('VCARD_UPLOAD_URL', '/kreativecrm/uploads/vcard/');

/* ===============================
   FORM SUBMIT
   =============================== */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$admin_id    = $_SESSION['user_id'] ?? 0;
    $full_name   = mysqli_real_escape_string($conn, $_POST['full_name']);
    $designation = mysqli_real_escape_string($conn, $_POST['designation']);
    $phone       = mysqli_real_escape_string($conn, $_POST['phone']);
    $email       = mysqli_real_escape_string($conn, $_POST['email']);
    $address     = mysqli_real_escape_string($conn, $_POST['address']);
    $about       = mysqli_real_escape_string($conn, $_POST['about']);
    $status      = 1;
    $created_at  = date('Y-m-d H:i:s');

if ($full_name == '') {
        $message = "Full name is required.";
    }

/* ===============================
       SLUG & DIRECTORY
       =============================== */
    $slug = strtolower(trim(
        preg_replace('/[^a-zA-Z0-9]+/', '-', $full_name)
    ));

$upload_dir = VCARD_UPLOAD_PATH . $slug . '/';

if (!is_dir($upload_dir)) {
        mkdir($upload_dir, 0777, true);
    }

/* ===============================
       UPLOAD FUNCTION
       =============================== */
    $allowed_ext = ['jpg','jpeg','png','webp'];

function uploadImage($file, $dir, $allowed_ext, &$message) {
        if (!empty($file['name'])) {

$ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
            if (!in_array($ext, $allowed_ext)) {
                $message = "Only JPG, JPEG, PNG, WEBP images allowed.";
                return "";
            }

$new_name = time() . "_" . preg_replace('/[^a-zA-Z0-9\._-]/', '_', $file['name']);

if (move_uploaded_file($file['tmp_name'], $dir . $new_name)) {
                return $new_name; // ✅ ONLY filename
            }

$message = "Image upload failed.";
        }
        return "";
    }

/* ===============================
       IMAGE UPLOADS
       =============================== */
    $profile_image = "";
    $banner_image  = "";
    $logo_image    = "";

if ($message == '') {
        $profile_image = uploadImage($_FILES['profile_image'], $upload_dir, $allowed_ext, $message);
        $banner_image  = uploadImage($_FILES['banner_image'],  $upload_dir, $allowed_ext, $message);
        $logo_image    = uploadImage($_FILES['logo'],          $upload_dir, $allowed_ext, $message);
    }

/* ===============================
       INSERT DATABASE
       =============================== */
    if ($message == '') {

$sql = "INSERT INTO vcards 
                (admin_id, card_slug, full_name, designation, phone, email, address, about,
                 profile_image, banner_image, logo, status, created_at)
                VALUES
                ('$admin_id', '$slug', '$full_name', '$designation', '$phone', '$email',
                 '$address', '$about', '$profile_image', '$banner_image', '$logo_image',
                 '$status', '$created_at')";

if (mysqli_query($conn, $sql)) {
            header("Location: vcard_list.php?msg=VCard added successfully");
            exit;
        } else {
            $message = "Database Error: " . mysqli_error($conn);
        }
    }
}
?>

<div class="page-body">
<div class="container-fluid">
<div class="row">
<div class="col-sm-12">

<div class="card">
<div class="card-header pb-0 card-no-border">
    <h2>Add VCard</h2>
</div>

<?php if ($message): ?>
    <div class="alert alert-danger"><?= htmlspecialchars($message); ?></div>
<?php endif; ?>

<div class="col-md-6">
    <label class="form-label">Designation</label>
    <input type="text" name="designation" class="form-control">
</div>

<div class="col-md-6 mt-3">
    <label class="form-label">Phone</label>
    <input type="text" name="phone" class="form-control">
</div>

<div class="col-md-6 mt-3">
    <label class="form-label">Email</label>
    <input type="email" name="email" class="form-control">
</div>

<div class="col-md-12 mt-3">
    <label class="form-label">Address</label>
    <textarea name="address" class="form-control"></textarea>
</div>

<div class="col-md-12 mt-3">
    <label class="form-label">About</label>
    <textarea name="about" class="form-control"></textarea>
</div>

<div class="col-md-4 mt-3">
    <label class="form-label">Profile Image</label>
    <input type="file" name="profile_image" class="form-control">
</div>

<div class="col-md-4 mt-3">
    <label class="form-label">Banner Image</label>
    <input type="file" name="banner_image" class="form-control">
</div>

<div class="col-md-4 mt-3">
    <label class="form-label">Company Logo</label>
    <input type="file" name="logo" class="form-control">
</div>

</div>

<br>
<button type="submit" class="btn btn-success">Save VCard</button>
<a href="vcard_list.php" class="btn btn-secondary">Cancel</a>

</form>

</div>
</div>

</div>
</div>
</div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>