Zploit 0-Day Shell

:: Editing File: product_save.php

<?php
include_once("session.php");
include("db.php");

$upload_dir = '../uploads/products/';

if (!is_dir($upload_dir)) {
    mkdir($upload_dir, 0777, true);
}

if ($_SERVER["REQUEST_METHOD"] == "POST") {

// --- Form Fields ---
    $category_id         = (int)($_POST['category_id'] ?? 0);
    $subcategory_id      = (int)($_POST['subcategory_id'] ?? 0);
    $sub_subcategory_id  = (int)($_POST['sub_subcategory_id'] ?? 0);

$name                = trim($_POST['name'] ?? '');
    $url                 = trim($_POST['url'] ?? '');

$actual_price        = trim($_POST['actual_price'] ?? '');
    $old_price           = trim($_POST['old_price'] ?? '');

$color_name          = trim($_POST['color_name'] ?? '');
    $color_code          = trim($_POST['color_code'] ?? '');

$size_name           = trim($_POST['size_name'] ?? '');

$description         = trim($_POST['description'] ?? '');
    $additional_info     = trim($_POST['additional_information'] ?? '');
    $shipping_return     = trim($_POST['shipping_return'] ?? '');

$image_path = NULL;

// --- Validation ---
    if (empty($name) || empty($category_id)) {
        $_SESSION['error'] = "Product Name and Category are required.";
        header("Location: product_add.php");
        exit;
    }

// --- Image Upload ---
    if (!empty($_FILES['image']['name']) && $_FILES['image']['error'] === UPLOAD_ERR_OK) {

$file_ext = strtolower(pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION));

$allowed_ext = ['jpg','jpeg','png','gif','webp'];

if (in_array($file_ext,$allowed_ext)) {

$new_file_name = uniqid('prod_').'.'.$file_ext;
            //$destination = $upload_dir.$new_file_name;
			
			
			 $full_dir = $upload_dir . $url . '/';

// create folder if not exists
			if (!is_dir($full_dir)) {
				mkdir($full_dir, 0777, true);
			}
			
			
            $destination = $full_dir.$new_file_name;

if (move_uploaded_file($_FILES['image']['tmp_name'],$destination)) {

$image_path = $new_file_name;

} else {

$_SESSION['error'] = "Failed to upload image.";
                header("Location: product_add.php");
                exit;

}

} else {

$_SESSION['error'] = "Invalid image format.";
            header("Location: product_add.php");
            exit;

}
    }

// --- Insert Query ---
    $sql = "INSERT INTO products
            (category_id, subcategory_id, sub_subcategory_id,
             name, url, image,
             actual_price, old_price,
             color_name, color_code,
             size_name,
             description, additional_information, shipping_return)
            VALUES
            (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";

$stmt = mysqli_prepare($conn, $sql);

mysqli_stmt_bind_param(
        $stmt,
        "iiisssddssssss",
        $category_id,
        $subcategory_id,
        $sub_subcategory_id,
        $name,
        $url,
        $image_path,
        $actual_price,
        $old_price,
        $color_name,
        $color_code,
        $size_name,
        $description,
        $additional_info,
        $shipping_return
    );

if (mysqli_stmt_execute($stmt)) {

$_SESSION['success'] = "Product '{$name}' added successfully!";
        header("Location: product.php");
        exit;

} else {

$_SESSION['error'] = "Database error: ".mysqli_error($conn);

if ($image_path && file_exists($upload_dir.$image_path)) {
            unlink($upload_dir.$image_path);
        }

header("Location: product_add.php");
        exit;
    }

mysqli_stmt_close($stmt);
    mysqli_close($conn);

} else {

$_SESSION['error'] = "Invalid request method.";
    header("Location: product_add.php");
    exit;

}
?>