Zploit 0-Day Shell

:: Editing File: client_edit.php

<?php
ob_start();
include 'header.php';

$page_title = "Edit Client";
$page_parent = "Clients";
$page_parent_link = "clients_list.php";

include 'breadcrumb.php';
include 'menu.php';

$message = "";

// ✅ Get client ID
if (!isset($_GET['id']) || empty($_GET['id'])) {
    header("Location: clients_list.php?msg=Invalid Client ID");
    exit;
}

$client_id = intval($_GET['id']);

// ✅ Fetch existing client data
$sql = "SELECT * FROM clients WHERE id = '$client_id'";
$result = mysqli_query($conn, $sql);
if (mysqli_num_rows($result) == 0) {
    header("Location: clients_list.php?msg=Client not found");
    exit;
}
$client = mysqli_fetch_assoc($result);

// ✅ Handle form submission
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $name        = mysqli_real_escape_string($conn, $_POST['name']);
    $address     = mysqli_real_escape_string($conn, $_POST['address']);
    $email       = mysqli_real_escape_string($conn, $_POST['email']);
    $phone       = mysqli_real_escape_string($conn, $_POST['phone']);
    $service_taken = isset($_POST['service_taken']) ? implode(', ', $_POST['service_taken']) : '';
    $message_txt = mysqli_real_escape_string($conn, $_POST['message']);
    $notes       = mysqli_real_escape_string($conn, $_POST['notes']);
    $domain      = mysqli_real_escape_string($conn, $_POST['domain_details']);
    $hosting     = mysqli_real_escape_string($conn, $_POST['hosting_details']);
    $digital     = mysqli_real_escape_string($conn, $_POST['digital_marketing_details']);
    $invoice_amt = mysqli_real_escape_string($conn, $_POST['invoice_amount']);
    $advance_received = mysqli_real_escape_string($conn, $_POST['advance_received']);
    $balance_due = mysqli_real_escape_string($conn, $_POST['balance_due']);
    $amount_det  = mysqli_real_escape_string($conn, $_POST['amount_details']);
    $convert_date = mysqli_real_escape_string($conn, $_POST['client_convert_date']);
    $updated_at  = date('Y-m-d H:i:s');

// ✅ Handle file upload
    $invoice_img = $client['invoice_img']; // keep old image if not changed
    if (!empty($_FILES['invoice_img']['name'])) {
        $target_dir = "uploads/invoices/";
        if (!file_exists($target_dir)) {
            mkdir($target_dir, 0777, true);
        }

$file_name = basename($_FILES['invoice_img']['name']);
        $file_ext = strtolower(pathinfo($file_name, PATHINFO_EXTENSION));
        $allowed_types = ['jpg', 'jpeg', 'png', 'pdf'];

if (in_array($file_ext, $allowed_types)) {
            $new_name = "invoice_" . time() . "." . $file_ext;
            $target_file = $target_dir . $new_name;

if (move_uploaded_file($_FILES['invoice_img']['tmp_name'], $target_file)) {
                $invoice_img = $target_file;

// Delete old file if exists
                if (!empty($client['invoice_img']) && file_exists($client['invoice_img'])) {
                    unlink($client['invoice_img']);
                }
            } else {
                $message = "Error uploading file.";
            }
        } else {
            $message = "Invalid file type. Only JPG, PNG, and PDF are allowed.";
        }
    }

// ✅ Update query
    $sql_update = "UPDATE clients SET 
                    name='$name', 
                    address='$address', 
                    email='$email', 
                    phone='$phone', 
                    service_taken='$service_taken', 
                    message='$message_txt', 
                    notes='$notes', 
                    domain_details='$domain', 
                    hosting_details='$hosting', 
                    digital_marketing_details='$digital', 
                    invoice_amount='$invoice_amt', 
                    advance_received='$advance_received', 
                    balance_due='$balance_due', 
                    amount_details='$amount_det', 
                    client_convert_date='$convert_date', 
                    invoice_img='$invoice_img',
                    updated_at='$updated_at'
                  WHERE id='$client_id'";

if (mysqli_query($conn, $sql_update)) {
        header("Location: clients_list.php?msg=Client updated successfully");
        exit;
    } else {
        $message = "Database Error: " . mysqli_error($conn);
    }
}
?>

<div class="page-body">
  <div class="container-fluid">
    <div class="row">
      <div class="col-sm-12">
        <div class="card">

<div class="card-header pb-0 card-no-border">
            <h2>Edit Client</h2>
          </div>

<div class="col-md-4">
                  <label class="form-label">Client Name</label>
                  <input type="text" name="name" class="form-control" value="<?= htmlspecialchars($client['name']); ?>" required>
                </div>

<div class="col-md-4">
                  <label class="form-label">Email</label>
                  <input type="email" name="email" class="form-control" value="<?= htmlspecialchars($client['email']); ?>">
                </div>

<div class="col-md-4">
                  <label class="form-label">Phone</label>
                  <input type="text" name="phone" class="form-control" value="<?= htmlspecialchars($client['phone']); ?>" required>
                </div>

<div class="col-md-6">
                  <label class="form-label">Address</label>
                  <textarea name="address" class="form-control" rows="3"><?= htmlspecialchars($client['address']); ?></textarea>
                </div>

<div class="col-md-6">
                  <label class="form-label">Message</label>
                  <textarea name="message" class="form-control" rows="3"><?= htmlspecialchars($client['message']); ?></textarea>
                </div>
                
                <div class="col-md-6">
                  <label class="form-label">Domain Details</label>
                  <textarea name="domain_details" class="form-control" rows="3"><?= htmlspecialchars($client['domain_details']); ?></textarea>
                </div>

<div class="col-md-6">
                  <label class="form-label">Hosting Details</label>
                  <textarea name="hosting_details" class="form-control" rows="3"><?= htmlspecialchars($client['hosting_details']); ?></textarea>
                </div>

<div class="col-md-6">
                  <label class="form-label">Digital Marketing Details</label>
                  <textarea name="digital_marketing_details" class="form-control" rows="3"><?= htmlspecialchars($client['digital_marketing_details']); ?></textarea>
                </div>

<!-- Amount Details --
                <div class="col-md-4">
                  <label class="form-label">Amount Details</label>
                  <textarea name="amount_details" class="form-control" rows="3"><?= htmlspecialchars($client['amount_details']); ?></textarea>
                </div>
				
                <!-- Invoice Amount --
                <div class="col-md-4">
                  <label class="form-label">Invoice Amount (₹)</label>
                  <input type="number" step="0.01" name="invoice_amount" class="form-control" value="<?= htmlspecialchars($client['invoice_amount']); ?>">
                </div>

<!-- Advance Received --
                <div class="col-md-4">
                  <label class="form-label">Advance Received Amount (₹)</label>
                  <input type="number" step="0.01" name="advance_received" class="form-control" value="<?= htmlspecialchars($client['advance_received']); ?>">
                </div>

<!-- Balance Due --
                <div class="col-md-4">
                  <label class="form-label">Balance Due Amount (₹)</label>
                  <input type="number" step="0.01" name="balance_due" class="form-control" value="<?= htmlspecialchars($client['balance_due']); ?>">
                </div>

<div class="col-md-6">
                  <label class="form-label">Notes</label>
                  <textarea name="notes" class="form-control" rows="3"><?= htmlspecialchars($client['notes']); ?></textarea>
                </div>

</div>

<div class="text-start mt-4">
                <button type="submit" class="btn btn-success">Update Client</button>
                <a href="clients_list.php" class="btn btn-secondary">Cancel</a>
              </div>

</form>

</div>
        </div>
      </div>
    </div>
  </div>
</div>

function calculateBalance() {
        const invoice = parseFloat(invoiceInput.value) || 0;
        const advance = parseFloat(advanceInput.value) || 0;
        const balance = invoice - advance;
        balanceInput.value = balance.toFixed(2);
    }

invoiceInput.addEventListener('input', calculateBalance);
    advanceInput.addEventListener('input', calculateBalance);
});
</script>

<?php include 'footer.php'; ob_end_flush(); ?>