Zploit 0-Day Shell

:: Editing File: vcard_edit.php

<?php
ob_start();
include 'header.php';

/* ===============================
   BREADCRUMB
   =============================== */
$page_title = "Edit VCard";
$page_parent = "VCards";
$page_parent_link = "vcard_list.php";

include 'breadcrumb.php';
include 'menu.php';

$message = "";
$vcard   = null;

/* ===============================
   PATH CONFIG (IMPORTANT)
   =============================== */

// Filesystem path
define('VCARD_UPLOAD_PATH', $_SERVER['DOCUMENT_ROOT'] . '/kreativecrm/uploads/vcard/');

// Public URL (only for preview if needed)
define('VCARD_UPLOAD_URL', '/kreativecrm/uploads/vcard/');

/* ===============================
   FETCH VCARD
   =============================== */
if (isset($_GET['id']) && is_numeric($_GET['id'])) {

$vcard_id = intval($_GET['id']);
    $res = mysqli_query($conn, "SELECT * FROM vcards WHERE id = $vcard_id");

if ($res && mysqli_num_rows($res) > 0) {
        $vcard = mysqli_fetch_assoc($res);
    } else {
        $message = "VCard not found.";
    }
} else {
    $message = "Invalid VCard ID.";
}

/* ===============================
   UPDATE FORM
   =============================== */
if ($_SERVER['REQUEST_METHOD'] === 'POST' && $vcard) {

$full_name   = mysqli_real_escape_string($conn, $_POST['full_name']);
    $designation = mysqli_real_escape_string($conn, $_POST['designation']);
    $phone       = mysqli_real_escape_string($conn, $_POST['phone']);
    $email       = mysqli_real_escape_string($conn, $_POST['email']);
    $address     = mysqli_real_escape_string($conn, $_POST['address']);
    $about       = mysqli_real_escape_string($conn, $_POST['about']);
    $status      = intval($_POST['status']);

/* KEEP OLD SLUG (IMPORTANT) */
    $slug = $vcard['card_slug'];

$upload_dir = VCARD_UPLOAD_PATH . $slug . '/';
    if (!is_dir($upload_dir)) {
        mkdir($upload_dir, 0777, true);
    }

$profile_image = $vcard['profile_image'];
    $banner_image  = $vcard['banner_image'];
    $logo_image    = $vcard['logo'];

$allowed_ext = ['jpg','jpeg','png','webp'];

/* ===============================
       IMAGE REPLACE FUNCTION
       =============================== */
    function replaceImage($file, $dir, $old, $allowed_ext, &$message) {

if (!empty($file['name'])) {

$ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
            if (!in_array($ext, $allowed_ext)) {
                $message = "Only JPG, JPEG, PNG, WEBP images allowed.";
                return $old;
            }

$new_name = time() . "_" . preg_replace('/[^a-zA-Z0-9\._-]/', '_', $file['name']);

if (move_uploaded_file($file['tmp_name'], $dir . $new_name)) {

if (!empty($old) && file_exists($dir . $old)) {
                    unlink($dir . $old);
                }
                return $new_name;
            }

$message = "Image upload failed.";
        }
        return $old;
    }

/* ===============================
       UPLOADS
       =============================== */
    if ($message == '') {
        $profile_image = replaceImage($_FILES['profile_image'], $upload_dir, $profile_image, $allowed_ext, $message);
        $banner_image  = replaceImage($_FILES['banner_image'],  $upload_dir, $banner_image,  $allowed_ext, $message);
        $logo_image    = replaceImage($_FILES['logo'],          $upload_dir, $logo_image,    $allowed_ext, $message);
    }

/* ===============================
       UPDATE DATABASE
       =============================== */
    if ($message == '') {

$sql = "UPDATE vcards SET
                    full_name      = '$full_name',
                    designation    = '$designation',
                    phone          = '$phone',
                    email          = '$email',
                    address        = '$address',
                    about          = '$about',
                    profile_image  = '$profile_image',
                    banner_image   = '$banner_image',
                    logo           = '$logo_image',
                    status         = '$status',
                    updated_at     = NOW()
                WHERE id = $vcard_id";

if (mysqli_query($conn, $sql)) {
            header("Location: vcard_list.php?msg=VCard updated successfully");
            exit;
        } else {
            $message = "Database Error: " . mysqli_error($conn);
        }
    }
}
?>

<div class="page-body">
<div class="container-fluid">
<div class="row">
<div class="col-sm-12">

<div class="card">
<div class="card-header pb-0 card-no-border">
    <h2>Edit VCard</h2>
</div>

<?php if ($message): ?>
    <div class="alert alert-warning"><?= htmlspecialchars($message); ?></div>
<?php endif; ?>

<?php if ($vcard): ?>
<form method="POST" enctype="multipart/form-data">

<div class="col-md-6">
    <label class="form-label">Full Name</label>
    <input type="text" name="full_name" class="form-control"
           value="<?= htmlspecialchars($vcard['full_name']); ?>" required>
</div>

<div class="col-md-6">
    <label class="form-label">Designation</label>
    <input type="text" name="designation" class="form-control"
           value="<?= htmlspecialchars($vcard['designation']); ?>">
</div>

<div class="col-md-6 mt-3">
    <label class="form-label">Phone</label>
    <input type="text" name="phone" class="form-control"
           value="<?= htmlspecialchars($vcard['phone']); ?>">
</div>

<div class="col-md-6 mt-3">
    <label class="form-label">Email</label>
    <input type="email" name="email" class="form-control"
           value="<?= htmlspecialchars($vcard['email']); ?>">
</div>

<div class="col-md-12 mt-3">
    <label class="form-label">Address</label>
    <textarea name="address" class="form-control"><?= htmlspecialchars($vcard['address']); ?></textarea>
</div>

<div class="col-md-12 mt-3">
    <label class="form-label">About</label>
    <textarea name="about" class="form-control"><?= htmlspecialchars($vcard['about']); ?></textarea>
</div>

<div class="col-md-4 mt-3">
    <label class="form-label">Replace Profile Image</label>
    <input type="file" name="profile_image" class="form-control">
    <?php if ($vcard['profile_image']): ?>
        <small class="text-muted">Current: <?= htmlspecialchars($vcard['profile_image']); ?></small>
    <?php endif; ?>
</div>

<div class="col-md-4 mt-3">
    <label class="form-label">Replace Banner Image</label>
    <input type="file" name="banner_image" class="form-control">
    <?php if ($vcard['banner_image']): ?>
        <small class="text-muted">Current: <?= htmlspecialchars($vcard['banner_image']); ?></small>
    <?php endif; ?>
</div>

<div class="col-md-4 mt-3">
    <label class="form-label">Replace Company Logo</label>
    <input type="file" name="logo" class="form-control">
    <?php if ($vcard['logo']): ?>
        <small class="text-muted">Current: <?= htmlspecialchars($vcard['logo']); ?></small>
    <?php endif; ?>
</div>

<div class="col-md-4 mt-3">
    <label class="form-label">Status</label>
    <select name="status" class="form-control">
        <option value="1" <?= $vcard['status']==1?'selected':''; ?>>Active</option>
        <option value="0" <?= $vcard['status']==0?'selected':''; ?>>Inactive</option>
    </select>
</div>

</div>

<br>
<button type="submit" class="btn btn-success">Update VCard</button>
<a href="vcard_list.php" class="btn btn-secondary">Cancel</a>

</form>
<?php endif; ?>

</div>
</div>

</div>
</div>
</div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>