Zploit 0-Day Shell

:: Editing File: callbackurl.php

<?php
session_start();
date_default_timezone_set("Asia/Kolkata");
include("db.php");

// ====== Step 1: Get callback payload ======
$callbackData = file_get_contents("php://input");
file_put_contents("callback_log.txt", $callbackData.PHP_EOL, FILE_APPEND);
$data = json_decode($callbackData, true);

if (!$data || !isset($data['payload'])) {
    http_response_code(400);
    echo "Invalid callback data";
    exit;
}

// Extract info
$payload       = $data['payload'];
$transactionId = $payload['paymentDetails'][0]['transactionId'] ?? null;
$orderId       = $payload['merchantOrderId'] ?? '';
$state         = $payload['state'] ?? '';

// ====== Step 2: Normalize status ======
$status = "Pending";
if ($state === "COMPLETED") {
    $status = "Completed";
} elseif ($state === "FAILED" || $state === "CANCELLED") {
    $status = "Failed";
}

// ====== Step 3: Get metaInfo ======
$member_id   = $payload['metaInfo']['udf1'] ?? null; // user_id
$plan_id     = $payload['metaInfo']['udf2'] ?? null; // plan id
$employee_id = $payload['metaInfo']['udf3'] ?? null;
$id          = $payload['metaInfo']['udf4'] ?? null; // payment_link_share_id
$action_date = date('Y-m-d');

// ====== Step 4: Fetch plan details ======
$sql_plans = "SELECT * FROM sub_plans WHERE plan_id = '$plan_id'";
$result_plans = mysqli_query($conn, $sql_plans);
if ($result_plans && mysqli_num_rows($result_plans) > 0) {
    $plan = mysqli_fetch_assoc($result_plans);
    $plan_month   = $plan['month'];
    $new_amount   = $plan['new_price'];
    $chat_request = $plan['chat_request'];
    $contact_views= $plan['contact_views'];
}
$expiry_date = date('Y-m-d', strtotime("+$plan_month month"));

// ====== Step 5: Insert / Update ======
if ($status === 'Completed') {
    // Insert into current_plan_details
    $sql_current_plan = "INSERT INTO current_plan_details 
        (user_id, plan_id, payment_amount, coupon_code, pay_amount, plan_expiry_date, status) 
        VALUES ('$member_id','$plan_id','$new_amount','','','$expiry_date','1')";
    mysqli_query($conn, $sql_current_plan);
    $last_id = mysqli_insert_id($conn);

// Handle payment_link_details - Update if exists (admin-initiated), Insert if not (direct member payment)
    if (!empty($id)) {
        // Admin-initiated payment - update existing record
        $sql_payment_link = "UPDATE payment_link_details 
                SET status = '$status', transaction_id = '$transactionId'
                WHERE payment_link_share_id = '$id'";
        mysqli_query($conn, $sql_payment_link);
    } else {
        // Direct member payment - insert new record (employee_id can be null for direct payments)
        $employee_id_sql = !empty($employee_id) ? "'$employee_id'" : "NULL";
        $sql_payment_link = "INSERT INTO payment_link_details 
                (current_plan_details_id, plan_id, employee_id, re_user_id, re_date, status, transaction_id) 
                VALUES ('$last_id', '$plan_id', $employee_id_sql, '$member_id', '$action_date', '$status', '$transactionId')";
        mysqli_query($conn, $sql_payment_link);
    }

// Insert into payment_paid_details
    $sql_payment_paid = "INSERT INTO payment_paid_details 
        (current_plan_details_id, payment_token, plan_id, payment_date, status) 
        VALUES ('$last_id','$transactionId','$plan_id','$action_date','Success')";
    mysqli_query($conn, $sql_payment_paid);

// Update members_current_plan
    $sql_chk_member = "SELECT * FROM members_current_plan WHERE user_id = '$member_id'";
    $res_chk_member = mysqli_query($conn, $sql_chk_member);
    if (mysqli_num_rows($res_chk_member) > 0) {
        $sql_update_member = "UPDATE members_current_plan SET plans_type = 'Paid' WHERE user_id = '$member_id'";
        mysqli_query($conn, $sql_update_member);
    } else {
        mysqli_query($conn, "INSERT INTO members_current_plan (user_id, plans_type) VALUES ('$member_id','Paid')");
    }

// Update user profile visibility
    mysqli_query($conn, "UPDATE user_details SET visible_status = '1' WHERE user_id = '$member_id'");

// Reset plan_viewed_total_request
    $sql_chk_view = "SELECT * FROM plan_viewed_total_request WHERE user_id = '$member_id'";
    $res_chk_view = mysqli_query($conn, $sql_chk_view);
    if (mysqli_num_rows($res_chk_view) > 0) {
        $sql_update_view = "UPDATE plan_viewed_total_request 
            SET total_contact_viewed = '0',
                remaining_contact_viewed = '$contact_views',
                chat_request_total = '0',
                chat_request_remaining = '$chat_request' 
            WHERE user_id = '$member_id'";
        mysqli_query($conn, $sql_update_view);
    } else {
        $sql_insert_view = "INSERT INTO plan_viewed_total_request 
            (user_id, total_contact_viewed, remaining_contact_viewed, chat_request_total, chat_request_remaining) 
            VALUES ('$member_id','0','$contact_views','0','$chat_request')";
        mysqli_query($conn, $sql_insert_view);
    }
} else {
    // Insert failed / pending log
    mysqli_query($conn, "INSERT INTO payment_paid_details 
        (current_plan_details_id, payment_token, plan_id, payment_date, status) 
        VALUES ('0','$transactionId','$plan_id','$action_date','$status')");
}

// ====== Step 6: Return acknowledgment ======
echo json_encode(["success" => true, "message" => "Callback processed"]);
?>