Zploit 0-Day Shell

:: Editing File: contact_form.php

<?php
session_start();
include('db.php');

// Set response header to JSON
header('Content-Type: application/json');

$name = $_POST['name'] ?? '';
$email = $_POST['email'] ?? '';
$subject = $_POST['sub'] ?? '';
$mobileNo = $_POST['number'] ?? '';
$message = $_POST['text'] ?? '';

// Simple validation
if (empty($name) || empty($email) || empty($subject) || empty($mobileNo) || empty($message)) {
    echo json_encode(['status' => 'error', 'message' => 'All required fields must be filled.']);
    exit;
}

// Validate email format
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    echo json_encode(['status' => 'error', 'message' => 'Please enter a valid email address.']);
    exit;
}

// Normalize mobile number (remove spaces, dashes, etc.)
$mobileNo = preg_replace('/[^0-9]/', '', $mobileNo);
$name = trim($name);
$subject = trim($subject);
$message = trim($message);

// Check for duplicate submission within last 5 minutes (same mobile number and name)
$checkDuplicate = $conn->prepare("SELECT id FROM enquiry WHERE mobile_no = ? AND full_name = ? AND submitted_at > DATE_SUB(NOW(), INTERVAL 5 MINUTE) ORDER BY submitted_at DESC LIMIT 1");
$checkDuplicate->bind_param("ss", $mobileNo, $name);
$checkDuplicate->execute();
$duplicateResult = $checkDuplicate->get_result();

if ($duplicateResult->num_rows > 0) {
    $checkDuplicate->close();
    echo json_encode(['status' => 'error', 'message' => 'You have already submitted a contact form recently. Please wait a few minutes before submitting again.']);
    exit;
}
$checkDuplicate->close();

// Check session-based duplicate prevention (prevent rapid multiple submissions)
$sessionKey = 'contact_form_submitted_' . md5($mobileNo . $name);
if (isset($_SESSION[$sessionKey])) {
    $lastSubmission = $_SESSION[$sessionKey];
    // If submitted within last 30 seconds, block it
    if (time() - $lastSubmission < 30) {
        echo json_encode(['status' => 'error', 'message' => 'Please wait a moment before submitting again.']);
        exit;
    }
}

// Prepare action_text with subject and message
$actionText = "Subject: " . $subject . "\n\nMessage: " . $message . "\n\nEmail: " . $email;
$profileFor = "Contact Form"; // Default value for contact form submissions
$religion = "N/A"; // Default value since contact form doesn't have religion field
$status = 'Pending';

// Insert into enquiry table
$stmt = $conn->prepare("INSERT INTO enquiry (profile_for, full_name, mobile_no, religion, action_text, status) VALUES (?, ?, ?, ?, ?, ?)");
$stmt->bind_param("ssssss", $profileFor, $name, $mobileNo, $religion, $actionText, $status);

// Execute and check
if ($stmt->execute()) {
    // Set session flag to prevent duplicate submissions
    $_SESSION[$sessionKey] = time();
    
    echo json_encode(['status' => 'success', 'message' => 'Thank you for contacting us! Your message has been submitted successfully.']);
} else {
    echo json_encode(['status' => 'error', 'message' => 'Error saving your message: ' . $stmt->error]);
}

// Close resources
$stmt->close();
$conn->close();
?>