Zploit 0-Day Shell

:: Editing File: delete_stock.php

<?php
include 'db.php';
include_once("session.php");

// Validate movement ID
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    $_SESSION['error'] = "Invalid request: No valid Stock Movement ID provided.";
    header("Location: stock_list.php");
    exit;
}

$movement_id = (int)$_GET['id'];

// Start transaction
mysqli_begin_transaction($conn);

try {

// 1. DELETE BOX BREAKDOWN FIRST
    $sql_boxes = "DELETE FROM stock_movement_boxes WHERE movement_id = $movement_id";
    if (!mysqli_query($conn, $sql_boxes)) {
        throw new Exception("Error deleting box data: " . mysqli_error($conn));
    }

// 2. DELETE MASTER STOCK MOVEMENT ENTRY
    $sql_main = "DELETE FROM stock_movements WHERE id = $movement_id";
    if (!mysqli_query($conn, $sql_main)) {
        throw new Exception("Error deleting stock movement: " . mysqli_error($conn));
    }

// Commit
    mysqli_commit($conn);

$_SESSION['success'] = "Stock movement deleted successfully.";
    header("Location: stock_list.php");
    exit;

} catch (Exception $e) {

// Rollback on error
    mysqli_rollback($conn);
    $_SESSION['error'] = "Delete failed: " . $e->getMessage();
    header("Location: stock_list.php");
    exit;
}
?>