Zploit 0-Day Shell

:: Editing File: ajax_get_box_stock.php

<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);

include("db.php");

header('Content-Type: application/json');

$product_id = isset($_GET['product_id']) ? (int)$_GET['product_id'] : 0;

/* ---------- DEFAULT RESPONSE ---------- */
$response = [
    'box_4H'   => 0,
    'box_5H'   => 0,
    'box_6H'   => 0,
    'box_7H'   => 0,
    'box_8H'   => 0,
    'box_9H'   => 0,
    'box_10H'  => 0,
    'box_CL'   => 0,
    'total_box'=> 0
];

if ($product_id <= 0) {
    echo json_encode($response);
    exit;
}

/* ---------- CALCULATE AVAILABLE STOCK ---------- */
$sql = "
SELECT
    SUM(CASE WHEN sm.movement_type='IN'  THEN sb.box_4H   ELSE -sb.box_4H  END) AS box_4H,
    SUM(CASE WHEN sm.movement_type='IN'  THEN sb.box_5H   ELSE -sb.box_5H  END) AS box_5H,
    SUM(CASE WHEN sm.movement_type='IN'  THEN sb.box_6H   ELSE -sb.box_6H  END) AS box_6H,
    SUM(CASE WHEN sm.movement_type='IN'  THEN sb.box_7H   ELSE -sb.box_7H  END) AS box_7H,
    SUM(CASE WHEN sm.movement_type='IN'  THEN sb.box_8H   ELSE -sb.box_8H  END) AS box_8H,
    SUM(CASE WHEN sm.movement_type='IN'  THEN sb.box_9H   ELSE -sb.box_9H  END) AS box_9H,
    SUM(CASE WHEN sm.movement_type='IN'  THEN sb.box_10H  ELSE -sb.box_10H END) AS box_10H,
    SUM(CASE WHEN sm.movement_type='IN'  THEN sb.box_CL   ELSE -sb.box_CL  END) AS box_CL,
    SUM(CASE WHEN sm.movement_type='IN'  THEN sb.total_box ELSE -sb.total_box END) AS total_box
FROM stock_movements sm
JOIN stock_movement_boxes sb ON sb.movement_id = sm.id
WHERE sm.product_id = $product_id
AND sm.status = 1
";

$q = mysqli_query($conn, $sql);

if ($q && mysqli_num_rows($q) > 0) {
    $row = mysqli_fetch_assoc($q);

foreach ($response as $k => $v) {
        $val = (int)($row[$k] ?? 0);
        $response[$k] = max(0, $val); // never negative
    }
}

echo json_encode($response);