Zploit 0-Day Shell

:: Editing File: grn_add.php

<?php
include_once("session.php");
include("db.php");
include("header.php");

// Handle form submit
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $po_id        = $_POST['po_id'] ?? '';
    $grn_date     = $_POST['grn_date'] ?? '';
    $received_qty = $_POST['received_qty'] ?? '';
    $remarks      = $_POST['remarks'] ?? '';

if ($po_id && $grn_date && $received_qty) {
        $sql = "INSERT INTO grns (po_id, grn_date, received_qty, remarks) VALUES (?, ?, ?, ?)";
        $stmt = $conn->prepare($sql);
        $stmt->bind_param("isds", $po_id, $grn_date, $received_qty, $remarks);

if ($stmt->execute()) {
            $_SESSION['success'] = "✅ GRN added successfully!";
            header("Location: grn_list.php");
            exit;
        } else {
            $_SESSION['error'] = "❌ Error: " . $stmt->error;
        }
        $stmt->close();
    } else {
        $_SESSION['error'] = "❌ Please fill all required fields.";
    }
}

// Fetch purchase orders for dropdown
$orders = mysqli_query($conn, "SELECT po.id, v.name, po.date, po.total
                               FROM purchase_orders po
                               JOIN vendors v ON po.vendor_id = v.id
                               ORDER BY po.id DESC");
if (!$orders) {
    die("PO query failed: " . mysqli_error($conn));
}
?>

<?php
                    if (isset($_SESSION['success'])) {
                        echo '<div class="alert alert-success" id="autoAlert">'.$_SESSION['success'].'</div>';
                        unset($_SESSION['success']);
                    }
                    if (isset($_SESSION['error'])) {
                        echo '<div class="alert alert-danger" id="autoAlert">'.$_SESSION['error'].'</div>';
                        unset($_SESSION['error']);
                    }
                    ?>

<form method="post" class="row g-3 app-form">
                        <div class="col-md-6">
                            <label class="form-label">Purchase Order <span class="text-danger">*</span></label>
                            <select name="po_id" class="form-control" required>
                                <option value="">-- Select PO --</option>
                                <?php while ($po = mysqli_fetch_assoc($orders)): ?>
                                    <option value="<?= $po['id'] ?>">
                                        PO#<?= $po['id'] ?> - <?= htmlspecialchars($po['name']) ?> (<?= $po['order_date'] ?>, ₹<?= $po['total_amount'] ?>)
                                    </option>
                                <?php endwhile; ?>
                            </select>
                        </div>

<div class="col-md-6">
                            <label class="form-label">Received Quantity <span class="text-danger">*</span></label>
                            <input type="number" step="0.01" name="received_qty" class="form-control" required>
                        </div>

<div class="col-md-12">
                            <label class="form-label">Remarks</label>
                            <textarea name="remarks" class="form-control" rows="2"></textarea>
                        </div>

</div>
            </div>
        </div>
    </div>
</main>

<?php include("footer.php"); ?>