Zploit 0-Day Shell

:: Editing File: login.php

<?php
include('../db.php');
date_default_timezone_set('Asia/Kolkata');        
if(isset($_POST["username"]))
{
 $response = array();
 $query = "
    SELECT * FROM user_details
    	WHERE email = :username OR mobile = :username";
$statement = $connect->prepare($query);
$statement->execute(
	array(
			'username'	=>	$_POST["username"]
		)
 );
$count = $statement->rowCount();
if($count > 0)
{
	$result = $statement->fetchAll();
	foreach($result as $row)
	{
		// if($row['user_status'] == 'Active')
		// {
			if($_POST["password"] == $row["password"])
			{

$user_id = $row['user_id']; 
                $user_token = $row['user_token'];
                $sv_user_id = $row['sv_user_id'];

$first_name = $row['first_name'];
                $last_name = $row['last_name'];
                $email = $row['email'];
                $mobile = $row['mobile'];

$response = array("status"=> "success", "data"=>array("user_id"=>$user_id, "user_token"=>$user_token, "sv_user_id"=>$sv_user_id, "first_name"=>$first_name, "email"=>$email, "mobile"=>$mobile));

}
			else
			{
				//$message = "Wrong Password";
                  //echo "2";
                  $response = array("status"=> "wrong_password");
			}
		// }
		// else
		// {
		// 	//$message = "Your account is Deactive Contact";
      //     //echo "3";
      //     $response = array("status"=> "disabled");
		// }
	}
}
else
{
	//$message = "Wrong Mobile Or Password";
    //echo "4";
    $response = array("status"=> "not_exist");

}
echo json_encode($response);
}
?>