Zploit 0-Day Shell

:: Editing File: vcard_company_delete.php

<?php
ob_start();
include 'header.php';

/* ===============================
   PATH CONFIG
   =============================== */
define('COMPANY_UPLOAD_PATH', $_SERVER['DOCUMENT_ROOT'].'/kreative_crm/uploads/company/');

/* ===============================
   VALIDATE ID
   =============================== */
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    header("Location: vcard_company_list.php?msg=Invalid Company ID");
    exit;
}

$id = intval($_GET['id']);

/* ===============================
   FETCH COMPANY
   =============================== */
$q = mysqli_query(
    $conn,
    "SELECT id, logo, banner_image
     FROM vcard_company
     WHERE id = '$id'"
);

if (!$q || mysqli_num_rows($q) === 0) {
    header("Location: vcard_company_list.php?msg=Company Not Found");
    exit;
}

$row = mysqli_fetch_assoc($q);

/* ===============================
   DELETE LOGO
   =============================== */
if (!empty($row['logo'])) {
    $logo_path = COMPANY_UPLOAD_PATH.'logo/'.$row['logo'];
    if (file_exists($logo_path)) {
        unlink($logo_path);
    }
}

/* ===============================
   DELETE BANNER
   =============================== */
if (!empty($row['banner_image'])) {
    $banner_path = COMPANY_UPLOAD_PATH.'banner/'.$row['banner_image'];
    if (file_exists($banner_path)) {
        unlink($banner_path);
    }
}

/* ===============================
   DELETE DB RECORD
   =============================== */
mysqli_query($conn, "DELETE FROM vcard_company WHERE id = '$id'");

/* ===============================
   REDIRECT
   =============================== */
header("Location: vcard_company_list.php?msg=Company deleted successfully");
exit;
?>