Zploit 0-Day Shell

:: Editing File: delete_team_member.php

<?php

include_once("session.php");
include("db.php"); // Database connection

// Ensure the user is logged in and has the session data required for notifications
$user_id = $_SESSION['user_id'] ?? 0;
$table_name = "team_details";

if (isset($_GET['id']) && is_numeric($_GET['id'])) {
  $employee_id = mysqli_real_escape_string($conn, $_GET['id']);

// 1. Prepare the SQL DELETE statement
  $sql = "DELETE FROM {$table_name} WHERE employee_id = '$employee_id'";

// 2. Execute the query
  if (mysqli_query($conn, $sql)) {
    // Success
    $_SESSION['success'] = "✅ Team Member ID: **{$employee_id}** deleted successfully!";
   
    // Add success notification
    $msg = "✅ Team Member Deleted successfully (ID: {$employee_id})";
    $type = "success";
    mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$user_id', '$msg', '$type')");

} else {
    // Error
    $_SESSION['error'] = "❌ Error deleting Team Member ID: **{$employee_id}**. " . mysqli_error($conn);
   
    // Add error notification
    $msg = "❌ Team Member Deletion Failed (ID: {$employee_id})";
    $type = "error";
    mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$user_id', '$msg', '$type')");
  }

} else {
  // ID was missing or invalid
  $_SESSION['error'] = "❌ Invalid request. Employee ID not provided or invalid.";
 
  // Add error notification
  $msg = "❌ Team Member Deletion Failed: Invalid ID.";
  $type = "error";
  mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$user_id', '$msg', '$type')");
}

// 3. Redirect back to the list page
header("Location: team_list.php");
exit();
?>