Zploit 0-Day Shell

:: Editing File: profile_update.php

<?php
include("session.php");
include("db.php");

$id       = $_POST['id'];
$username = mysqli_real_escape_string($conn, $_POST['username']);
$password = mysqli_real_escape_string($conn, $_POST['password']);
$role     = mysqli_real_escape_string($conn, $_POST['role']);

// Handle file upload
$image_sql = "";
if (!empty($_FILES['image']['name'])) {
    $target_dir = "uploads/";
    if (!is_dir($target_dir)) mkdir($target_dir, 0777, true);

$image_name = time() . "_" . basename($_FILES['image']['name']);
    $target_file = $target_dir . $image_name;

if (move_uploaded_file($_FILES['image']['tmp_name'], $target_file)) {
        $image_sql = ", user_image='uploads/$image_name'";
    }
}

// Update user
 $sql = "UPDATE users SET username='$username', role='$role', password='$password' $image_sql WHERE id=$id";

if (mysqli_query($conn, $sql)) {
    $_SESSION['user_name'] = $username;
    $_SESSION['user_role'] = $role;
    $_SESSION['success'] = "Profile updated successfully!";
	
	 $msg = "✅ User profile updated successfully!";
	 $type = "success";
	 
	 mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$id', '$msg', '$type')");
		
} else {
    $_SESSION['error'] = "Error updating profile!";
	
		$msg = "❌ Database error while updating Profile!";
        $type = "error";
        mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$id', '$msg', '$type')");
        
		
}
//die;

header("Location: profile.php");
exit();

//assets/images/avatar/3.png
?>