Zploit 0-Day Shell

:: Editing File: signup.php

<?php 
include('db.php');
date_default_timezone_set('Asia/Kolkata');

// Set response header to JSON
header('Content-Type: application/json');

$last_id = 0;
$sql_last_id = "SELECT * FROM user_details ORDER BY user_id DESC LIMIT 1";
$result_last_id = mysqli_query($conn, $sql_last_id);
if (mysqli_num_rows($result_last_id) > 0) {
  foreach ($result_last_id as $row) {
   $last_id = $row['user_id'] + 1;
  }
}

$sv_user_id = 'SV' . str_pad($last_id, 5, '0', STR_PAD_LEFT);
$user_token = md5(uniqid().rand(1000000, 9999999));
$profile_for = $_POST['profile_for'] ?? '';
$gender  = $_POST['gender'] ?? '';
$marital_status = $_POST['marital_status'] ?? '';
$first_name = $_POST['first_name'] ?? '';
$last_name  = $_POST['last_name'] ?? '';
$date_of_birth  = $_POST['date_of_birth'] ?? '';
$your_religion  = $_POST['your_religion'] ?? '';
$caste  = $_POST['caste'] ?? '';
$sub_caste  = $_POST['sub_caste'] ?? '';
$community = $_POST['community'] ?? '';
$living_in  = $_POST['living_in'] ?? '';
$mobile_no  = $_POST['mobile_no'] ?? '';
$email  = $_POST['email'] ?? '';
$password  = $_POST['password'] ?? '';
$registration_date = date('Y-m-d');
$last_login = date('Y-m-d H:i:s');
$birthDate = new DateTime($date_of_birth);
$currentDate = new DateTime();
$age = $currentDate->diff($birthDate)->y;

// Normalize mobile number (remove spaces, dashes, etc.)
$mobile_no = preg_replace('/[^0-9]/', '', $mobile_no);
$email = trim(strtolower($email));

// Validate required fields
if (empty($mobile_no) || empty($email) || empty($first_name) || empty($last_name)) {
  echo json_encode(['status' => 'error', 'message' => 'All required fields must be filled.']);
  exit;
}

// Check for duplicate mobile number using prepared statement
$sql_chk_mobile = $conn->prepare("SELECT user_id FROM user_details WHERE mobile = ? LIMIT 1");
$sql_chk_mobile->bind_param("s", $mobile_no);
$sql_chk_mobile->execute();
$result_chk_mobile = $sql_chk_mobile->get_result();

if (mysqli_num_rows($result_chk_mobile) > 0) {
  $sql_chk_mobile->close();
  echo json_encode(['status' => 'error', 'message' => 'This mobile number is already registered. Please use a different mobile number.']);
  exit;
}
$sql_chk_mobile->close();

// Check for duplicate email using prepared statement
$sql_chk_email = $conn->prepare("SELECT user_id FROM user_details WHERE LOWER(email) = ? LIMIT 1");
$sql_chk_email->bind_param("s", $email);
$sql_chk_email->execute();
$result_chk_email = $sql_chk_email->get_result();

if (mysqli_num_rows($result_chk_email) > 0) {
  $sql_chk_email->close();
  echo json_encode(['status' => 'error', 'message' => 'This email address is already registered. Please use a different email address.']);
  exit;
}
$sql_chk_email->close();

// Use prepared statement for INSERT to prevent SQL injection
$sql = $conn->prepare("INSERT INTO `user_details`(`user_token`, `sv_user_id`, `first_name`, `last_name`, `date_of_birth`, `age`, `gender`, `religion`, `caste`, `sub_caste`, `community`, `living_in`, `profile_for`, `marital_status`, `mobile`, `email`, `password`, `registration_date`, `last_login`, `verified_status`, `status`, `visible_status`) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, '0', '0', '1')");
$sql->bind_param("sssssissssssssssssss", $user_token, $sv_user_id, $first_name, $last_name, $date_of_birth, $age, $gender, $your_religion, $caste, $sub_caste, $community, $living_in, $profile_for, $marital_status, $mobile_no, $email, $password, $registration_date, $last_login);

if ($sql->execute()) {   
  $user_id = mysqli_insert_id($conn);
  $sql_profile = "INSERT INTO `profile_images`(`user_id`, `profile_img`, `cover_img`) VALUES ('$user_id','default.jpg', 'default_cover.jpg')";
  mysqli_query($conn, $sql_profile);

$sql_account_status = "INSERT INTO `account_status`(`user_id`, `account_status`) VALUES ('$user_id','Active')";
  mysqli_query($conn, $sql_account_status);

$display_name_as_title = $first_name.' '.substr($last_name, 0, 1)."XXX";

$sql_privacy_setting = "INSERT INTO `privacy_setting`(`user_id`, `sv_user_id`, `display_name_as`, `display_name_as_title`, `phone`, `phone_title`, `email`, `email_title`, `photo`, `photo_title`, `date_of_birth`, `date_of_birth_title`, `annual_income`, `annual_income_title`) VALUES ('$user_id','$sv_user_id','1','$display_name_as_title','2','Visible to Premium','3','Hide my Email Id','2','Visible to Premium','2','Show only the Month & Year (mm/yyyy)','3','Keep this private')";
  mysqli_query($conn, $sql_privacy_setting);

$sql_insert_plan = "INSERT INTO `members_current_plan`(`current_detatils_plan_id`, `user_id`, `plans_type`) VALUES ('','$user_id','Free')";
	  mysqli_query($conn, $sql_insert_plan);
   	
   	$sql->close();
   	$response = array("status"=> "success", "message" => "Account created successfully!", "data"=>array("user_id"=>$user_id, "user_token"=>$user_token, "sv_user_id"=>$sv_user_id, "first_name"=>$first_name, "email"=>$email, "mobile"=>$mobile_no));    
}
else{
	$sql->close();
	$response = array("status"=> "error", "message" => "Failed to create account. Please try again later.");
}

echo json_encode($response);
?>