Zploit 0-Day Shell

:: Editing File: delete_party_payment.php

<?php
include 'db.php';
include_once("session.php");

// check that an id was provided and is numeric
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    $_SESSION['error'] = "Invalid request.";
    header("Location: list_payments.php");
    exit;
}

$payment_id = (int)$_GET['id'];
$user_id = isset($_SESSION['user_id']) ? (int)$_SESSION['user_id'] : 0;

// start transaction
mysqli_begin_transaction($conn);

try {
    // Optionally fetch the payment row for logging or to get party_id for notification
    $fetchSql = "SELECT id, party_id, amount FROM payment WHERE id = ?";
    if ($stmtFetch = mysqli_prepare($conn, $fetchSql)) {
        mysqli_stmt_bind_param($stmtFetch, "i", $payment_id);
        if (!mysqli_stmt_execute($stmtFetch)) {
            throw new Exception("Failed to fetch payment: " . mysqli_error($conn));
        }
        $res = mysqli_stmt_get_result($stmtFetch);
        $paymentRow = $res ? mysqli_fetch_assoc($res) : null;
        mysqli_stmt_close($stmtFetch);

if (!$paymentRow) {
            throw new Exception("Payment not found or already deleted.");
        }
    } else {
        throw new Exception("Prepare failed for fetch: " . mysqli_error($conn));
    }

// Delete the payment
    $delSql = "DELETE FROM payment WHERE id = ?";
    if ($stmtDel = mysqli_prepare($conn, $delSql)) {
        mysqli_stmt_bind_param($stmtDel, "i", $payment_id);
        if (!mysqli_stmt_execute($stmtDel)) {
            throw new Exception("Failed to delete payment: " . mysqli_error($conn));
        }

// ensure a row was actually deleted
        if (mysqli_stmt_affected_rows($stmtDel) === 0) {
            throw new Exception("Payment not found or already deleted.");
        }

mysqli_stmt_close($stmtDel);
    } else {
        throw new Exception("Prepare failed for delete: " . mysqli_error($conn));
    }

// Optional: insert notification (using prepared statement)
    $notifSql = "INSERT INTO notifications (user_id, message, type) VALUES (?, ?, ?)";
    if ($stmtNotif = mysqli_prepare($conn, $notifSql)) {
        $msg = "✅ Payment deleted (ID: {$payment_id}, Party ID: {$paymentRow['party_id']}, Amount: {$paymentRow['amount']})";
        $type = "warning";
        mysqli_stmt_bind_param($stmtNotif, "iss", $user_id, $msg, $type);
        mysqli_stmt_execute($stmtNotif);
        mysqli_stmt_close($stmtNotif);
    }

// commit transaction
    mysqli_commit($conn);
    $_SESSION['success'] = "Payment deleted successfully.";
    header("Location: list_payments.php");
    exit;

} catch (Exception $e) {
    // rollback and return error
    mysqli_rollback($conn);
    $_SESSION['error'] = "Error deleting payment: " . $e->getMessage();
    header("Location: list_payments.php");
    exit;
}
?>