Zploit 0-Day Shell

:: Editing File: vendors_edit.php

<?php 
include_once("session.php");
include("db.php"); // check login session
include("header.php");

<div class="row m-1">
            <div class="col-12">
                <h4 class="main-title">Edit Vendor</h4>
                <ul class="app-line-breadcrumbs mb-3">
                    <li>
                        <a class="f-s-14 f-w-500" href="dashboard.php">
                            <i class="ph-duotone ph-bank f-s-16"></i> Home
                        </a>
                    </li>
                    <li>
                        <a class="f-s-14 f-w-500" href="vendors_list.php">
                            <i class="ph-duotone ph-table f-s-16"></i> Vendor List
                        </a>
                    </li>
                    <li class="active">
                        <a class="f-s-14 f-w-500" href="#">Edit Vendor</a>
                    </li>
                </ul>
            </div>
        </div>

<?php
		
		$user_id = $_SESSION['user_id'];
		
        // Get vendor ID from URL
        if (isset($_GET['id']) && is_numeric($_GET['id'])) {
            $vendor_id = intval($_GET['id']);
            $result = mysqli_query($conn, "SELECT * FROM vendors WHERE id='$vendor_id'");
            $vendor = mysqli_fetch_assoc($result);
			
            if (!$vendor) {
                $_SESSION['error'] = "❌ Vendor not found!";
                header("Location: vendors_list.php");
                exit;
            }
        } else {
            $_SESSION['error'] = "❌ Invalid Vendor ID!";
            header("Location: vendors_list.php");
            exit;
        }

// Handle form submission
        if ($_SERVER['REQUEST_METHOD'] === 'POST') {
            $code    = mysqli_real_escape_string($conn, $_POST['vendor_code']);
            $name    = mysqli_real_escape_string($conn, $_POST['name']);
            $phone   = mysqli_real_escape_string($conn, $_POST['phone']);
            $email   = mysqli_real_escape_string($conn, $_POST['email']);
            $gst     = mysqli_real_escape_string($conn, $_POST['gst']);
            $address = mysqli_real_escape_string($conn, $_POST['address']);
			$bank_details = mysqli_real_escape_string($conn, $_POST['bank_details']);
			$remark = mysqli_real_escape_string($conn, $_POST['remark']);
			$notes = mysqli_real_escape_string($conn, $_POST['notes']);
            $id      = intval($_POST['id']); // vendor id

$sql = "UPDATE vendors SET 
                        vendor_code='$code',
                        name='$name',
                        phone='$phone',
                        email='$email',
                        gst='$gst',
						bank_details='$bank_details',
						remark='$remark',
						notes='$notes',
                        address='$address'
                    WHERE id='$id'";

if (mysqli_query($conn, $sql)) {
                $_SESSION['success'] = "✅ Vendor updated successfully!";
                
                $msg = "✅ Vendor updated successfully!";
                $type = "success";
                mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$user_id', '$msg', '$type')");
                
				header("Location: vendors_list.php");
               // exit;
            } else {
                $_SESSION['error'] = "❌ Error updating vendor!";
                
                $msg = "❌ Vendor update failed!";
                $type = "error";
                mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$user_id', '$msg', '$type')");
            }
        }
        ?>

<?php 
                        if (isset($_SESSION['success'])) {
                            echo '<div class="alert alert-success" id="autoAlert">'.$_SESSION['success'].'</div>';
                            unset($_SESSION['success']);
                        }
                        if (isset($_SESSION['error'])) {
                            echo '<div class="alert alert-danger" id="autoAlert">'.$_SESSION['error'].'</div>';
                            unset($_SESSION['error']);
                        }
                        ?>

<div class="col-md-6">
                                <label class="form-label" for="code">Vendor Code</label>
                                <input class="form-control" id="code" name="vendor_code" type="text" 
                                    value="<?php echo htmlspecialchars($vendor['vendor_code']); ?>" required>
                            </div>
                            
                            <div class="col-md-6">
                                <label class="form-label" for="name">Vendor Name</label>
                                <input class="form-control" id="name" name="name" type="text" 
                                    value="<?php echo htmlspecialchars($vendor['name']); ?>" required>
                            </div>
                            
                            <div class="col-md-4">
                                <label class="form-label" for="phone">Phone</label>
                                <input class="form-control" id="phone" name="phone" type="text" 
                                    value="<?php echo htmlspecialchars($vendor['phone']); ?>" required>
                            </div>
                            <div class="col-md-4">
                                <label class="form-label" for="email">Email</label>
                                <input class="form-control" id="email" name="email" type="email" 
                                    value="<?php echo htmlspecialchars($vendor['email']); ?>" required>
                            </div>
                            <div class="col-md-4">
                                <label class="form-label" for="gst">GST Number</label>
                                <input class="form-control" id="gst" name="gst" type="text" 
                                    value="<?php echo htmlspecialchars($vendor['gst']); ?>">
                            </div>
                            <div class="col-md-6">
                                <label class="form-label" for="address">Address</label>
                                <textarea class="form-control" id="address" name="address" rows="3"><?php echo htmlspecialchars($vendor['address']); ?></textarea>
                            </div>
							
							<div class="col-md-6">
								<label class="form-label" for="bank_details">Bank Details</label>
								<textarea class="form-control" id="bank_details" name="bank_details" rows="3"><?php echo htmlspecialchars($vendor['bank_details']); ?></textarea>
							</div>

<div class="col-md-6">
								<label class="form-label" for="remark">Remark</label>
								<textarea class="form-control" id="remark" name="remark" rows="3"><?php echo htmlspecialchars($vendor['remark']); ?></textarea>
							</div>

<div class="col-md-6">
								<label class="form-label" for="notes">Notes</label>
								<textarea class="form-control" id="notes" name="notes" rows="3"><?php echo htmlspecialchars($vendor['notes']); ?></textarea>
							</div>
                            <div class="col-12">
                                <button type="submit" class="btn btn-primary">Update Vendor</button>
                            </div>
                        </form>

</div>
                </div>
            </div>
        </div>

</div>
</main>

<?php include("footer.php"); ?>