Zploit 0-Day Shell

:: Editing File: quotations_send.php

<?php
ob_start();
include 'header.php';

// ✅ Page setup
$page_parent = "Quotation";
$page_parent_link = "quotation.php";
$page_title = "Send Quotation (Module)";

include 'breadcrumb.php';
include 'menu.php';
?>

<div class="page-body">
    <div class="container-fluid">
        <div class="row">
            <div class="col-sm-12">
                <div class="card">
                    <div class="card-header">
                        <h2>Send Quotation via WhatsApp</h2>
                    </div>
                    <div class="card-body">
                        <form method="POST">
                            <div class="row">
                                
                                <div class="col-md-12">
                                    <label class="form-label">Select Quotation</label>
                                    <select name="q_id" class="form-control" required>
                                        <option value="">-- Select Quotation --</option>
                                        <?php
                                        $qList = mysqli_query($conn, "SELECT id, name FROM qutation ORDER BY id DESC");
                                        while ($row = mysqli_fetch_assoc($qList)) {
                                            echo "<option value='{$row['id']}'>{$row['name']}</option>";
                                        }
                                        ?>
                                    </select>
                                </div>

<div class="col-md-12 mt-3">
                                    <label class="form-label">Mobile Number</label>
                                    <input type="text" name="mobile" class="form-control" placeholder="Enter WhatsApp number" required>
                                </div>

<div class="text-center mt-5">
                                    <button type="submit" name="send_now" class="btn btn-success" style="background:#00d757;border:none;">
                                        <i class="fa fa-whatsapp"></i> Send via WhatsApp
                                    </button>
                                    <a href="quotation.php" class="btn btn-secondary">Back</a>
                                </div>
                            </div>
                        </form>

<?php
                        // ✅ When form is submitted
                        if (isset($_POST['send_now'])) {
                            $q_id = intval($_POST['q_id']);
                            $mobile = mysqli_real_escape_string($conn, $_POST['mobile']);
                            $created_at = date('Y-m-d H:i:s');

// ✅ Get quotation details
                            $qData = mysqli_query($conn, "SELECT * FROM qutation WHERE id='$q_id'");
                            $qutation = mysqli_fetch_assoc($qData);

if ($qutation) {
                                $pdf_path = "uploads/quotation/" . $qutation['pdf_path'];
                                $base_url = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http") . "://{$_SERVER['HTTP_HOST']}" . dirname($_SERVER['SCRIPT_NAME']) . "/";
                                $full_pdf_url = $base_url . $pdf_path;

// ✅ Insert record into qutation_send table
                                $insert = "INSERT INTO qutation_send (q_id, mobile, created_at) VALUES ('$q_id', '$mobile', '$created_at')";
                                mysqli_query($conn, $insert);

// ✅ Send via WhatsApp
                                $msg = "Hello,%0A%0APlease find your quotation below:%0A" . urlencode($full_pdf_url);
                                $whatsapp_url = "https://wa.me/{$mobile}?text={$msg}";

echo "<script>window.open('$whatsapp_url', '_blank');</script>";
                                echo "<script>alert('Quotation sent successfully!');window.location='quotation.php';</script>";
                            } else {
                                echo "<script>alert('Invalid quotation selected.');</script>";
                            }
                        }
                        ?>
                    </div>
                </div>
            </div>
        </div>
    </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>