Zploit 0-Day Shell

:: Editing File: product.php

<?php

require_once 'db.php'; 
require_once 'session.php'; 
include "header.php";

// --- Initialize variables ---
$status  = $_GET['status'] ?? '';
$message = htmlspecialchars($_GET['msg'] ?? '');
$cid  = isset($_GET['cid']) ? (int)$_GET['cid'] : 0;

$products = [];

// --- BASE QUERY ---
$sql = "SELECT 
        p.id,
        p.image,
        p.name,
        p.url,
        p.actual_price,
        p.old_price,
        p.color_name,
        p.size_name,
        p.created_at,
        c.name AS category_name,
        s.name AS subcategory_name,
        ss.name AS sub_subcategory_name

FROM products p

LEFT JOIN categories c 
        ON p.category_id = c.id

LEFT JOIN subcategories s 
        ON p.subcategory_id = s.id

LEFT JOIN sub_subcategories ss 
        ON p.sub_subcategory_id = ss.id
";

// 👉 APPLY FILTER ONLY IF cid EXISTS
if ($cid > 0) {
    $sql .= " WHERE p.sub_subcategory_id = ?";
}

$sql .= " ORDER BY p.id DESC";

// --- PREPARE ---
$stmt = mysqli_prepare($conn, $sql);

if ($stmt) {

// 👉 BIND PARAM ONLY IF FILTER EXISTS
    if ($cid > 0) {
        mysqli_stmt_bind_param($stmt, "i", $cid);
    }

mysqli_stmt_execute($stmt);
    $result = mysqli_stmt_get_result($stmt);

if ($result && mysqli_num_rows($result) > 0) {

while ($row = mysqli_fetch_assoc($result)) {
            $products[] = $row;
        }

}

mysqli_stmt_close($stmt);

} else {
    $status = 'danger';
    $message = 'Database query failed: ' . mysqli_error($conn);
}

mysqli_close($conn);
?>

<div class="page-breadcrumb d-none d-sm-flex align-items-center mb-3">

<div class="breadcrumb-title pe-3">Products</div>

<li class="breadcrumb-item active">Products</li>

</ol>
</nav>
</div>

</div>

<div class="col-sm-9">
<h5 class="mb-0">Product List</h5>
</div>

<div class="col-sm-3 text-end">
<a href="product_add.php" class="btn btn-primary">Add Product</a>
</div>

</div>

<?php if ($status === 'success'): ?>

<div class="alert alert-success alert-dismissible fade show">
<strong>Success!</strong> <?= $message ?>
<button type="button" class="btn-close" data-bs-dismiss="alert"></button>
</div>

<?php elseif ($status === 'danger'): ?>

<div class="alert alert-danger alert-dismissible fade show">
<strong>Error!</strong> <?= $message ?>
<button type="button" class="btn-close" data-bs-dismiss="alert"></button>
</div>

<?php endif; ?>

<tr>

<th>Image</th>

<th>Category</th>

<th>Sub Category</th>

<th>Sub Sub Category</th>

<!--
<th>Price</th>

<th>Old Price</th>

<th>Color</th>

<th>Created At</th>
-->

<th class="text-center">Actions</th>

</tr>

</thead>

<tbody>

<?php if (empty($products)): ?>

<tr>
<td colspan="13" class="text-center">No products found.</td>
</tr>

<?php else: ?>

<?php $sr = 1; foreach ($products as $prod): ?>

<tr>

<td>

<?php 
$image = !empty($prod['image']) 
? "../uploads/products/" .htmlspecialchars($prod['url']) . "/" . htmlspecialchars($prod['image']) 
: "assets/images/placeholder.jpg";
?>

<img src="<?= $image ?>" class="rounded-3"
style="width:50px;height:50px;object-fit:cover;">

</td>

<!--
<td>₹<?= htmlspecialchars($prod['actual_price']) ?></td>

<a href="product_view.php?id=<?= $prod['id'] ?>" title="view">

<i class="lni lni-save"></i> View </a> | 
<a href="product_edit.php?id=<?= $prod['id'] ?>" title="Edit">
<i class="lni lni-pencil-alt"></i> Edit 
</a>  |

<a href="product_delete.php?id=<?= $prod['id'] ?>"
onclick="return confirm('Are you sure you want to delete this product?')"
class="text-danger" title="Delete">

<i class="lni lni-trash"></i> Delete

</a>

</div>

</td>

</tr>

<?php endforeach; ?>

<?php endif; ?>

</tbody>

</table>

</div>

</div>
</div>

<?php include "footer.php"; ?>