Zploit 0-Day Shell

:: Editing File: subcategory_update.php

<?php
// subcategory_update.php

require_once 'db.php';
require_once 'session.php';

// Upload folder
$upload_dir = '../uploads/subcategory/';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

// 1️⃣ Sanitize Inputs
    $subcategory_id = (int)($_POST['subcategory_id'] ?? 0);
    $category_id    = (int)($_POST['category_id'] ?? 0);
    $name           = trim($_POST['name'] ?? '');
    $subheading     = trim($_POST['subheading'] ?? '');
    $content        = trim($_POST['content'] ?? '');
    $url            = trim($_POST['url'] ?? '');
    $sort_order     = (int)($_POST['sort_order'] ?? 0);
    $old_image_path = $_POST['old_image_path'] ?? '';

if ($subcategory_id <= 0 || $category_id <= 0 || $name === '') {
        $_SESSION['error'] = "Invalid request: Subcategory ID, Category or name missing.";
        header("Location: subcategory.php");
        exit;
    }

// 2️⃣ Auto Slug Generate
    if (empty($url)) {
        $url = strtolower(preg_replace('/[^a-z0-9]+/', '-', trim($name)));
        $url = trim($url, '-');
    }

// 3️⃣ Image Upload
    $new_image_name = $old_image_path;
    $file_uploaded = false;

if (isset($_FILES['image']) && $_FILES['image']['error'] === UPLOAD_ERR_OK) {

$file_name = $_FILES['image']['name'];
        $file_tmp  = $_FILES['image']['tmp_name'];
        $file_ext  = strtolower(pathinfo($file_name, PATHINFO_EXTENSION));

$allowed = ['jpg','jpeg','png','gif','webp'];

if (in_array($file_ext,$allowed)) {

$unique_name = uniqid('subcat_').'.'.$file_ext;
            $target_path = $upload_dir.$unique_name;

if (move_uploaded_file($file_tmp,$target_path)) {

$new_image_name = $unique_name;
                $file_uploaded = true;

} else {

$_SESSION['error']="Failed to upload image.";
                header("Location: subcategory_edit.php?id=$subcategory_id");
                exit;

}

} else {

$_SESSION['error']="Invalid image format.";
            header("Location: subcategory_edit.php?id=$subcategory_id");
            exit;

}
    }

// 4️⃣ Update Query
    $sql = "UPDATE subcategories
            SET category_id=?,
                name=?,
                subheading=?,
                content=?,
                url=?,
                sort_order=?,
                image=?
            WHERE id=?";

$stmt = mysqli_prepare($conn,$sql);

if(!$stmt){
        $_SESSION['error']="Database error: ".mysqli_error($conn);
        header("Location: subcategory_edit.php?id=$subcategory_id");
        exit;
    }

mysqli_stmt_bind_param(
        $stmt,
        "issssisi",
        $category_id,
        $name,
        $subheading,
        $content,
        $url,
        $sort_order,
        $new_image_name,
        $subcategory_id
    );

if(mysqli_stmt_execute($stmt)){

// delete old image
        if($file_uploaded && !empty($old_image_path) && $old_image_path!=$new_image_name){

$old_file=$upload_dir.basename($old_image_path);

if(file_exists($old_file)){
                unlink($old_file);
            }

}

$_SESSION['success']="Subcategory <strong>{$name}</strong> updated successfully!";
        header("Location: subcategory.php");
        exit;

}else{

$_SESSION['error']="Error updating subcategory: ".mysqli_error($conn);

if($file_uploaded && file_exists($upload_dir.$new_image_name)){
            unlink($upload_dir.$new_image_name);
        }

header("Location: subcategory_edit.php?id=$subcategory_id");
        exit;
    }

mysqli_stmt_close($stmt);
    mysqli_close($conn);

}else{

$_SESSION['error']="Invalid request method.";
    header("Location: subcategory.php");
    exit;

}
?>