Zploit 0-Day Shell

:: Editing File: p.php

<?php
// page1-cover.php
?>

<?php
include 'conn/db.php';
?>

<!DOCTYPE html>
<html>
<head>
    <style>

.logo5 {
            text-align: center;
            margin-bottom: 15px;
        }

.logo5 img {
            width: 180px;
            display:inline;
        }

.title {
            text-align: center;
            font-size: 20px;
            font-weight: bold;
            margin-top: 10px;
            margin-bottom: 5px;
            letter-spacing: 1px;
        }

.subtitle-line {
            width: 100%;
            height: 8px;
            background: #566473;
            margin: 15px 0 25px 0;
        }

.info-table {
            width: 100%;
            border-collapse: collapse;
        }

.info-table th {
            background: #f1f1f1;
            padding: 8px;
            border: 1px solid #ccc;
            font-size: 13px;
            text-align: center;
        }

.info-table td {
            padding: 10px;
            border: 1px solid #ccc;
            vertical-align: top;
        }

.block-title {
            font-weight: bold;
            margin-bottom: 6px;
        }

.footer-note {
            margin-top: 40px;
            font-size: 11px;
            text-align: center;
            color: #666;
        }
    </style>
</head>

<body>

<center><div class="logo5">
    <img src="<?= __DIR__ . '/../assets/images/logo.png' ?>" alt="PSA Happy Home" width=120px>
</div>
</center>

<div class="title">QUOTATION</div>

<table class="info-table">
    <tr>
        <th width="50%">PREPARED BY</th>
        <th width="50%">CLIENT DETAILS</th>
    </tr>
    <tr>
        <td>
            <div class="block-title">PSA HAPPY HOME</div>
            Address: 5TH CROSS SIDDHESHWAR<br>
            Nagar Shimoga, Karnataka<br>
            PIN Code: 577203<br><br>

Contact Number: 9333658028<br>
            Email: yesgrowtech@gmail.com<br><br>

</td>

<?php 
        
        
$id = (int)$_GET['id']; // Force it to be an integer for security

$sql = "SELECT 
            q.client_name, 
            q.client_address, 
            q.site_dimension, 
            q.client_pincode, 
            q.client_phone, 
            q.client_email,
            q.pic
        FROM quotations q
        WHERE q.id = $id 
        AND q.status = 1 
        LIMIT 1";

$result = mysqli_query($conn, $sql);

if (!$result) {
    die("Query Failed: " . mysqli_error($conn));
}

$data = mysqli_fetch_assoc($result);
?>
        <!--
        <td>
            <div class="block-title">ELITE HOMES</div>
            Address: Willington<br>
            Hinjewadi Pune<br>
            PIN Code: 400703<br><br>

Contact Number: XXXXXXXXXX
        </td>-->
        <td>
            <div class="block-title">
                <?= htmlspecialchars($data['client_name']) ?>
            </div>
            Address: <?= nl2br(htmlspecialchars($data['client_address'])) ?><br>
            PIN Code: <?= htmlspecialchars($data['client_pincode']) ?><br><br>
             <?php if(!empty($data['client_phone'])){ ?>
            Contact Number : <?= htmlspecialchars($data['client_phone']) ?><br>
            <?php } ?>
            <?php if(!empty($data['client_email'])){ ?>
            Email : <?= htmlspecialchars($data['client_email']) ?><br><br>
            <?php } ?>
            <?php if (!empty($data['site_dimension'])): ?>
             Site Dimension:  <?= htmlspecialchars($data['site_dimension']) ?><br>
           
            <?php endif; ?>
            
            
            
            
            
        </td>

</tr>
</table>

<br><br>

<center><div class="logo7">
   
    
    <?php
// 1. Get the raw path from database (e.g., uploads/quotations_all/annpoorna/...)
$raw_path = $data['pic'];

// 2. Create a Web-Friendly URL (Relative to the quatation folder)
// Since q_po.php is in /quatation/, we use '../' to go to the root /psahappyhome/
$image_url = "../" . $raw_path;

// 3. For mPDF/Server-side background checks, you DO use __DIR__
$server_path = __DIR__ . "/../" . $raw_path;
?>

<?php  if (!empty($raw_path)): ?>
    <div style="text-align: center; margin: 20px auto;">
        <img src="<?php echo $image_url; ?>" 
             style="width:700px; height:500px; margin:0px auto; border:5px solid #e6e6e6; object-fit: cover; display: block;" 
             alt="<?php echo $image_url; ?>">
    </div>
<?php endif;  ?>

</div>
</center>
</body>
</html>