Zploit 0-Day Shell

:: Editing File: vendors_add.php

<?php 
include_once("session.php");
include("db.php"); // check login session
include("header.php");
?>

<div class="row m-1">
            <div class="col-12">
                <h4 class="main-title">Add Vendor</h4>
                <ul class="app-line-breadcrumbs mb-3">
                    <li>
                        <a class="f-s-14 f-w-500" href="dashboard.php">
                            <i class="ph-duotone ph-bank f-s-16"></i> Home
                        </a>
                    </li>
					 <li>
                        <a class="f-s-14 f-w-500" href="vendors_list.php">
                            <i class="ph-duotone ph-table f-s-16"></i> Vendor List
                        </a>
                    </li>
                    <li class="active">
                        <a class="f-s-14 f-w-500" href="#">Add Vendor</a>
                    </li>
                </ul>
            </div>
        </div>

<?php
		$user_id = $_SESSION['user_id'];
		
        if ($_SERVER['REQUEST_METHOD'] === 'POST') {
			$code    = mysqli_real_escape_string($conn, $_POST['code']);
            $name    = mysqli_real_escape_string($conn, $_POST['name']);
            $phone   = mysqli_real_escape_string($conn, $_POST['phone']);
            $email   = mysqli_real_escape_string($conn, $_POST['email']);
            $gst     = mysqli_real_escape_string($conn, $_POST['gst']);
            $address = mysqli_real_escape_string($conn, $_POST['address']);
			$bank_details = mysqli_real_escape_string($conn, $_POST['bank_details']);
			$remark = mysqli_real_escape_string($conn, $_POST['remark']);
			$notes = mysqli_real_escape_string($conn, $_POST['notes']);
			
			$id = mysqli_real_escape_string($conn, $_POST['id']);

$sql = "INSERT INTO vendors (vendor_code,name, phone, email, gst, address, bank_details, remark, notes) 
                    VALUES ('$code', '$name',  '$phone', '$email', '$gst', '$address', '$bank_details','$remark', '$notes')";

if (mysqli_query($conn, $sql)) {
                $_SESSION['success'] = "✅ Vendor added successfully!";
				
				 $msg = "✅ Vendor Added successfully!";
				 $type = "success";
				 
				 mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$id', '$msg', '$type')");
						 
            } else {
				
				$msg = "❌ Vendor Added Failed ! ";
				$type = "error";
				mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$id', '$msg', '$type')");
							
                $_SESSION['error'] = "❌ Error adding vendor!";
            }
        }
		
		
		
		
        ?>

<?php 
                        if (isset($_SESSION['success'])) {
                            echo '<div class="alert alert-success" id="autoAlert">'.$_SESSION['success'].'</div>';
                            unset($_SESSION['success']);
                        }
                        if (isset($_SESSION['error'])) {
                            echo '<div class="alert alert-danger" id="autoAlert">'.$_SESSION['error'].'</div>';
                            unset($_SESSION['error']);
                        }
                        ?>

<div class="col-md-6">
    <label class="form-label" for="vendor_code">Vendor Code*</label>
    <input class="form-control" id="vendor_code" name="code" type="text" required>
</div>

<div class="col-md-6">
    <label class="form-label" for="vendor_name">Vendor Name*</label>
    <input class="form-control" id="vendor_name" name="name" type="text" required>
</div>

<div class="col-md-4">
    <label class="form-label" for="phone">Phone</label>
    <input class="form-control" id="phone" name="phone" type="text">
</div>

<div class="col-md-4">
    <label class="form-label" for="email">Email</label>
    <input class="form-control" id="email" name="email" type="email">
</div>

<div class="col-md-4">
    <label class="form-label" for="gst">GST Number</label>
    <input class="form-control" id="gst" name="gst" type="text">
</div>

<div class="col-md-6">
    <label class="form-label" for="address">Address</label>
    <textarea class="form-control" id="address" name="address" rows="3"></textarea>
</div>

<div class="col-md-6">
    <label class="form-label" for="bank_details">Bank Details</label>
    <textarea class="form-control" id="bank_details" name="bank_details" rows="3"></textarea>
</div>

<div class="col-md-6">
    <label class="form-label" for="remark">Remark</label>
    <textarea class="form-control" id="remark" name="remark" rows="3"></textarea>
</div>

<div class="col-md-6">
    <label class="form-label" for="notes">Notes</label>
    <textarea class="form-control" id="notes" name="notes" rows="3"></textarea>
</div>

<div class="col-12">
                                <button type="submit" class="btn btn-primary">Add Vendor</button>
                            </div>
                        </form>

</div>
                </div>
            </div>
        </div>

</div>
</main>

<?php include("footer.php"); ?>