Zploit 0-Day Shell

:: Editing File: vcards_add.php

<?php
ob_start();
include 'header.php';

$page_title = "Add VCard";
include 'breadcrumb.php';
include 'menu.php';

/* ===============================
   PATH CONFIG
   =============================== */
define('VCARD_UPLOAD_PATH', $_SERVER['DOCUMENT_ROOT'].'/kreative_crm/uploads/vcard/');

$error = "";

/* ===============================
   FORM SUBMIT
   =============================== */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$admin_id    = 1; // change if dynamic admin
    $company_id  = !empty($_POST['company_id']) ? intval($_POST['company_id']) : NULL;

$card_slug   = mysqli_real_escape_string($conn, $_POST['card_slug']);
    $full_name   = mysqli_real_escape_string($conn, $_POST['full_name']);
    $designation = mysqli_real_escape_string($conn, $_POST['designation']);
    $phone       = mysqli_real_escape_string($conn, $_POST['phone']);
    $email       = mysqli_real_escape_string($conn, $_POST['email']);
    $status      = isset($_POST['status']) ? 1 : 0;

$profile_image = NULL;

/* ===============================
       VALIDATE SLUG UNIQUE
       =============================== */
    $chk = mysqli_query($conn, "SELECT id FROM vcards WHERE card_slug='$card_slug'");
    if (mysqli_num_rows($chk) > 0) {
        $error = "Card slug already exists.";
    }

/* ===============================
       CREATE VCARD DIRECTORY
       =============================== */
    if ($error == '') {

$upload_dir = VCARD_UPLOAD_PATH . $card_slug . '/';
        if (!is_dir($upload_dir)) {
            mkdir($upload_dir, 0777, true);
        }

/* ===============================
           PROFILE IMAGE UPLOAD
           =============================== */
        if (!empty($_FILES['profile_image']['name'])) {

$ext = strtolower(pathinfo($_FILES['profile_image']['name'], PATHINFO_EXTENSION));
            $profile_image = time().'_profile.'.$ext;

move_uploaded_file(
                $_FILES['profile_image']['tmp_name'],
                $upload_dir . $profile_image
            );
        }

/* ===============================
           INSERT DATABASE
           =============================== */
        $sql = "INSERT INTO vcards
                (admin_id, company_id, card_slug, full_name, designation, phone, email, profile_image, status, created_at)
                VALUES (
                    '$admin_id',
                    ".($company_id ? "'$company_id'" : "NULL").",
                    '$card_slug',
                    '$full_name',
                    '$designation',
                    '$phone',
                    '$email',
                    ".($profile_image ? "'$profile_image'" : "NULL").",
                    '$status',
                    NOW()
                )";

if (mysqli_query($conn, $sql)) {
            header("Location: vcards_list.php?msg=VCard Added Successfully");
            exit;
        } else {
            $error = mysqli_error($conn);
        }
    }
}
?>

<div class="page-body">
<div class="container-fluid">
<div class="card">
<div class="card-body">

<?php if ($error): ?>
<div class="alert alert-danger"><?= htmlspecialchars($error); ?></div>
<?php endif; ?>

<form method="POST" enctype="multipart/form-data">
<div class="row">

<div class="col-md-6 mb-3">
<label class="form-label">Company *</label>
<select name="company_id " class="form-control" required>
<?php
$q = mysqli_query($conn,"SELECT id, name FROM vcard_company WHERE status=1 ORDER BY name");
while($r=mysqli_fetch_assoc($q)){
    echo "<option value='{$r['id']}'>".htmlspecialchars($r['name'])."</option>";
}
?>
</select>
</div>

<div class="col-md-6 mb-3">
<label class="form-label">Full Name *</label>
<input type="text" name="full_name" class="form-control" required>
</div>

<div class="col-md-6 mb-3">
<label class="form-label mt-3">Designation</label>
<input type="text" name="designation" class="form-control">
</div>

<div class="col-md-6 mb-3">
<label class="form-label mt-3">Phone</label>
<input type="text" name="phone" class="form-control">
</div>

<div class="col-md-6 mb-3">
<label class="form-label mt-3">Email</label>
<input type="email" name="email" class="form-control">
</div>

<div class="col-md-6 mb-3">
<label class="form-label mt-3">Card Slug *</label>
<input type="text" name="card_slug" class="form-control" required>
<small class="text-muted">Example: harshad-patel</small>
</div>

<div class="col-md-6 mb-3">
<label class="form-label mt-3">Profile Image</label>
<input type="file" name="profile_image" class="form-control">
</div>

<div class="col-md-6 mb-3">
    <label class="form-label mt-3">Status</label><br>
<label class="form-label mt-3">
    <input type="checkbox" name="status" checked> Active
</label>
</div>

<br><br>
<div class="col-md-12 mb-3">
<button type="submit" class="btn btn-success">Save VCard</button>
<a href="vcards_list.php" class="btn btn-secondary">Cancel</a>
</div>

</div>
</form>

</div>
</div>
</div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>