Zploit 0-Day Shell

:: Editing File: vcard_media_add.php

<?php
ob_start();
include 'header.php';

$page_title = "Add VCard Media";
include 'breadcrumb.php';
include 'menu.php';

/* ===============================
   PATH CONFIG
   =============================== */
define('VCARD_UPLOAD_PATH', $_SERVER['DOCUMENT_ROOT'].'/kreativecrm/uploads/vcard/');

$error = "";

/* ===============================
   FORM SUBMIT
   =============================== */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$vcard_id = intval($_POST['vcard_id']);
    $type     = $_POST['type']; // image | video | file
    $url      = trim($_POST['url'] ?? '');
    $status   = isset($_POST['status']) ? 1 : 0;

$file_path  = NULL;
    $image_path = NULL;

/* ===============================
       GET VCARD SLUG
       =============================== */
    $vcard_q = mysqli_query($conn, "SELECT card_slug FROM vcards WHERE id='$vcard_id'");
    $vcard   = mysqli_fetch_assoc($vcard_q);

if (!$vcard) {
        $error = "Invalid VCard selected.";
    } else {

$slug = $vcard['card_slug'];
        $upload_dir = VCARD_UPLOAD_PATH.$slug.'/media/';

if (!is_dir($upload_dir)) {
            mkdir($upload_dir, 0777, true);
        }

/* ===============================
           FILE UPLOAD (IMAGE / FILE)
           =============================== */
        if (($type == 'image' || $type == 'file') && !empty($_FILES['file_path']['name'])) {

$ext = strtolower(pathinfo($_FILES['file_path']['name'], PATHINFO_EXTENSION));
            $file_path = time().'_media.'.$ext;

move_uploaded_file(
                $_FILES['file_path']['tmp_name'],
                $upload_dir.$file_path
            );
        }

/* ===============================
           VIDEO URL
           =============================== */
        if ($type == 'video') {
            $file_path = NULL;
            $url = mysqli_real_escape_string($conn, $url);
        } else {
            $url = NULL;
        }

/* ===============================
           THUMBNAIL IMAGE (image_path)
           =============================== */
        if (!empty($_FILES['image_path']['name'])) {

$ext = strtolower(pathinfo($_FILES['image_path']['name'], PATHINFO_EXTENSION));
            $image_path = time().'_thumb.'.$ext;

move_uploaded_file(
                $_FILES['image_path']['tmp_name'],
                $upload_dir.$image_path
            );
        }

/* ===============================
           INSERT DATABASE
           =============================== */
        mysqli_query($conn, "
            INSERT INTO vcard_media
            (vcard_id, type, file_path, image_path, url, status, created_at)
            VALUES
            (
                '$vcard_id',
                '$type',
                ".($file_path ? "'$file_path'" : "NULL").",
                ".($image_path ? "'$image_path'" : "NULL").",
                ".($url ? "'$url'" : "NULL").",
                '$status',
                NOW()
            )
        ");

header("Location: vcard_media_list.php?msg=Media Added Successfully");
        exit;
    }
}
?>

<div class="page-body">
<div class="container-fluid">
<div class="card">
<div class="card-body">

<?php if ($error): ?>
<div class="alert alert-danger"><?= htmlspecialchars($error); ?></div>
<?php endif; ?>

<label class="form-label">VCard *</label>
<select name="vcard_id" class="form-control" required>
<?php
$q = mysqli_query($conn,"SELECT id, full_name FROM vcards WHERE status=1 ORDER BY full_name");
while($r=mysqli_fetch_assoc($q)){
    echo "<option value='{$r['id']}'>".htmlspecialchars($r['full_name'])."</option>";
}
?>
</select>

<label class="form-label mt-3">Media Type *</label>
<select name="type" class="form-control" required>
    <option value="image">Image</option>
    <option value="video">Video</option>
    <option value="file">File</option>
</select>

<label class="form-label mt-3">Upload File / Image</label>
<input type="file" name="file_path" class="form-control">

<label class="form-label mt-3">Video URL (Only for video)</label>
<input type="text" name="url" class="form-control">

<label class="form-label mt-3">Thumbnail Image (image_path)</label>
<input type="file" name="image_path" class="form-control">

<label class="form-label mt-3">
<input type="checkbox" name="status" checked> Active
</label>

<br><br>
<button type="submit" class="btn btn-success">Save Media</button>
<a href="vcard_media_list.php" class="btn btn-secondary">Cancel</a>

</form>

</div>
</div>
</div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>