Zploit 0-Day Shell

:: Editing File: login_old.php

<?php
require_once("config.php"); // include DB connection

if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $username = trim($_POST['username']);
    $password = trim($_POST['password']);
    $role     = $_POST['role'] ?? 'admin';

// Prepare SQL safely
    $stmt = $mysqli->prepare("SELECT id, username, password_hash, role 
                              FROM users 
                              WHERE username = ? AND role = ?");
    if (!$stmt) {
        die("Prepare failed: " . $mysqli->error);
    }

$stmt->bind_param("ss", $username, $role);
    $stmt->execute();
    $result = $stmt->get_result();

if ($result && $result->num_rows > 0) {
        $user = $result->fetch_assoc();

// ⚠️ Plain text password check
        if ($password === $user['password_hash']) {
            // Save user session
            $_SESSION['user'] = [
                "id"       => $user['id'],
                "username" => $user['username'],
                "role"     => $user['role']
            ];
            // Redirect to dashboard
            header("Location: dashboard.php");
            exit;
        } else {
            $_SESSION['error'] = "❌ Invalid password!";
        }
    } else {
        $_SESSION['error'] = "❌ Invalid username or role!";
    }

$stmt->close();

// Redirect back to login form with error
    header("Location: index.php"); // your login form file
    exit;
}