Zploit 0-Day Shell

:: Editing File: images_products_delete.php

<?php
// images_products_delete.php - Handles the deletion of a Product Image

require_once 'db.php'; 
require_once 'session.php';

$image_id = (int)$_GET['id'];
$groups_id = (int)$_GET['groups_id']; // Needed for redirection
$redirect_to = "images_products.php";

$success = false;
$old_image_path = null;

// Start a transaction for data integrity
mysqli_begin_transaction($conn);

try {
    // 2. Fetch the current image path before deletion
    $sql_fetch = "SELECT image FROM groupsimages WHERE id = ?";
    $stmt_fetch = mysqli_prepare($conn, $sql_fetch);
    
    if ($stmt_fetch) {
        mysqli_stmt_bind_param($stmt_fetch, "i", $image_id);
        mysqli_stmt_execute($stmt_fetch);
        mysqli_stmt_bind_result($stmt_fetch, $old_image_path);
        mysqli_stmt_fetch($stmt_fetch);
        mysqli_stmt_close($stmt_fetch);
    }

// 3. Prepare and Execute DELETE Query
    $sql_delete = "DELETE FROM groupsimages WHERE id = ?";
    $stmt_delete = mysqli_prepare($conn, $sql_delete);

if ($stmt_delete) {
        mysqli_stmt_bind_param($stmt_delete, "i", $image_id);
        
        if (mysqli_stmt_execute($stmt_delete)) {
            // Commit the deletion from the database
            mysqli_commit($conn);
            $success = true;
            mysqli_stmt_close($stmt_delete);
        } else {
            throw new Exception("Database execution error: " . mysqli_stmt_error($stmt_delete));
        }
    } else {
        throw new Exception("Database preparation error: " . mysqli_error($conn));
    }

} catch (Exception $e) {
    // Rollback changes if anything failed
    mysqli_rollback($conn);
    $_SESSION['error'] = "Failed to delete product image: " . $e->getMessage();
    header("Location: " . $redirect_to);
    exit;
}

// 4. Delete File from Server (Only if database deletion was successful)
if ($success) {
    // Check if a path exists, the file exists on disk, and it's a file
    if (!empty($old_image_path) && file_exists($old_image_path) && is_file($old_image_path)) {
        // Attempt to delete the file
        unlink($old_image_path); 
    }

$_SESSION['success'] = "Product image (ID: {$image_id}) deleted successfully. 🗑️";
    header("Location: " . $redirect_to);
    exit;
}

mysqli_close($conn);