Zploit 0-Day Shell

:: Editing File: verify_otp.php

<?php
session_start();
include "db.php";

if (!isset($_SESSION['login_email'])) {
    header("Location: login.php");
    exit;
}

$email = $_SESSION['login_email'];
$message = "";

if (isset($_POST['verify'])) {
    $otp_entered = $_POST['otp'];

$res = mysqli_query($conn, "SELECT * FROM users WHERE email='$email' AND otp='$otp_entered' LIMIT 1");

if (mysqli_num_rows($res) == 1) {

$row = mysqli_fetch_assoc($res);

// If payment not done → redirect to payment page
        if ($row['is_paid'] != 1) {
            $_SESSION['user_id'] = $row['id'];
            header("Location: payment.php?user_id=".$row['id']);
            exit;
        }

// Successful login → Set session
        $_SESSION['user_id'] = $row['id'];

// Clear OTP
        mysqli_query($conn, "UPDATE users SET otp='' WHERE id=".$row['id']);

header("Location: dashboard.php");
        exit;
    } else {
        $message = "❌ Invalid OTP";
    }
}
?>
<!DOCTYPE html>
<html>
<head>
<title>Verify OTP</title>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css">
</head>

<div class="card shadow p-4">
<h3 class="text-center mb-4">Enter OTP</h3>

<?php if($message!=""){ ?>
<div class="alert alert-danger text-center"><?php echo $message; ?></div>
<?php } ?>

<button type="submit" name="verify" class="btn btn-success w-100">Verify OTP</button>

</form>

</div>

</div>
</div>
</div>
</body>
</html>