Zploit 0-Day Shell

:: Editing File: profile-edit.php

<?php 
require_once 'db.php'; 
require_once 'session.php';

$user_id = $_SESSION['id'];
$user_data = [
    'username' => 'N/A',
    'email_id' => 'N/A',
    'role' => 'N/A',
    'location' => 'N/A',
    'message' => 'No bio provided',
    'user_pic' => 'assets/images/avatars/default.png', // Default image path
    'created_at' => 'N/A',
    'updated_at' => 'N/A'
];
$sql = "SELECT username, email_id, role, location, message, user_pic, created_at, updated_at FROM users WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);

if ($stmt) {
    mysqli_stmt_bind_param($stmt, "i", $user_id);
    mysqli_stmt_execute($stmt);
    $result = mysqli_stmt_get_result($stmt);

if ($row = mysqli_fetch_assoc($result)) {
        // Overwrite defaults with fetched data
        $user_data = array_merge($user_data, $row);
        
        // Ensure the profile picture path is valid, otherwise use default
        if (empty($user_data['user_pic']) || !file_exists($user_data['user_pic'])) {
            $user_data['user_pic'] = 'assets/favicon.png';
        }
    }
    mysqli_stmt_close($stmt);
}
mysqli_close($conn);

$status = isset($_GET['status']) ? $_GET['status'] : ''; 
$message = isset($_GET['msg']) ? htmlspecialchars($_GET['msg']) : '';

include"header.php";
?>

<div class="page-content-wrapper">
          
         <div class="page-content">

<div class="page-breadcrumb d-none d-sm-flex align-items-center mb-3">
            <div class="breadcrumb-title pe-3">Home</div>
            <div class="ps-3">
              <nav aria-label="breadcrumb">
                <ol class="breadcrumb mb-0 p-0 align-items-center">
                  <li class="breadcrumb-item"><a href="javascript:;"><ion-icon name="home-outline"></ion-icon></a>
                  </li>
                  <li class="breadcrumb-item active" aria-current="page">Edit Profile</li>
                </ol>
              </nav>
            </div>
           
          </div>

<div class="row">
            <div class="col-lg-8 mx-auto">
              <div class="card radius-10">
                <div class="card-body">
				
				
				<?php if ($status === 'success'): ?>
					<div class="alert alert-success alert-dismissible fade show" role="alert">
						<strong>Success!</strong> <?php echo $message; ?>
						<button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
					</div>
				<?php elseif ($status === 'danger'): ?>
					<div class="alert alert-danger alert-dismissible fade show" role="alert">
						<strong>Error!</strong> <?php echo $message; ?>
						<button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
					</div>
				<?php endif; ?>
		
                  <form method="post" enctype="multipart/form-data" action="profile_save.php">
                
                  <div class="mb-2 d-flex flex-column gap-3 align-items-center justify-content-center">
                    <div class="user-change-photo shadow">
                      
					  <img src="<?php echo htmlspecialchars($user_data['user_pic']); ?>" width="" alt="Profile Picture">
					  
                    </div>
                    <input type="file" name="user_pic_file" class="btn btn-outline-primary btn-sm radius-30 px-4" style="width: 250px;padding:10px;">
						
                  </div>
                  <h5 class="mb-0 mt-4">User Information</h5>
                  <hr>
                  <div class="row g-3">
                    <div class="col-6">
                       <label class="form-label">Full Name</label>
                       <input type="text" class="form-control" name="full_name" value="<?php echo htmlspecialchars($user_data['username']); ?>">
                    </div>
                    <div class="col-6">
                     <label class="form-label">Email address</label>
                     <input type="text" class="form-control" name="email_id" value="<?php echo htmlspecialchars($user_data['email_id']); ?>">
                   </div>
                     <div class="col-6">
                     <label class="form-label">Role</label>
                     <input type="text" class="form-control" name="role" value="<?php echo htmlspecialchars($user_data['role']); ?>">
                   </div>
				   <div class="col-6">
                    <label class="form-label">Location</label>
                    <input type="text" class="form-control" name="location" value="<?php echo htmlspecialchars($user_data['location']); ?>">
                   </div>
                 </div>
    
                 <h5 class="mb-0 mt-4">Contact Information</h5>
                 <hr>
					<div class="row g-3">
					  <div class="col-12">
						<label class="form-label">About Me</label>
						<textarea class="form-control" rows="4" cols="4" name="message"><?php echo htmlspecialchars($user_data['message']); ?></textarea>
					   </div>
					</div>
					
					  <div class="text-start mt-3">
						<input type="submit"  name="save_profile" class="btn btn-primary px-4" value="Save Changes" />
					  </div>
                </div>
               </form>
              </div>
            </div>
          </div>

</div>
          
         </div>
         
     </div>

<?php include"footer.php"?>