Zploit 0-Day Shell

:: Editing File: vcards_edit.php

<?php
ob_start();
include 'header.php';

$page_title = "Edit VCard";
$page_parent = "VCards";
$page_parent_link = "vcards_list.php";

include 'breadcrumb.php';
include 'menu.php';

/* ===============================
   PATH CONFIG
   =============================== */
define('VCARD_UPLOAD_PATH', $_SERVER['DOCUMENT_ROOT'].'/kreative_crm/uploads/vcard/');

/* ===============================
   VALIDATE ID
   =============================== */
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    header("Location: vcards_list.php?msg=Invalid VCard ID");
    exit;
}

$id = intval($_GET['id']);

/* ===============================
   FETCH VCARD
   =============================== */
$q = mysqli_query($conn, "SELECT * FROM vcards WHERE id='$id'");
if (!$q || mysqli_num_rows($q) === 0) {
    header("Location: vcards_list.php?msg=VCard Not Found");
    exit;
}
$row = mysqli_fetch_assoc($q);

$old_slug = $row['card_slug'];
$upload_dir = VCARD_UPLOAD_PATH . $old_slug . '/';

if (!is_dir($upload_dir)) {
    mkdir($upload_dir, 0777, true);
}

/* ===============================
   FORM SUBMIT
   =============================== */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$company_id  = !empty($_POST['company_id']) ? intval($_POST['company_id']) : NULL;

$card_slug   = mysqli_real_escape_string($conn, $_POST['card_slug']);
    $full_name   = mysqli_real_escape_string($conn, $_POST['full_name']);
    $designation = mysqli_real_escape_string($conn, $_POST['designation']);
    $phone       = mysqli_real_escape_string($conn, $_POST['phone']);
    $email       = mysqli_real_escape_string($conn, $_POST['email']);
    $status      = isset($_POST['status']) ? 1 : 0;

$profile_image = $row['profile_image'];

/* ===============================
       CHECK SLUG UNIQUE
       =============================== */
    if ($card_slug !== $old_slug) {
        $chk = mysqli_query($conn, "SELECT id FROM vcards WHERE card_slug='$card_slug' AND id!='$id'");
        if (mysqli_num_rows($chk) > 0) {
            $error = "Card slug already exists.";
        }
    }

/* ===============================
       RENAME FOLDER IF SLUG CHANGED
       =============================== */
    if (empty($error) && $card_slug !== $old_slug) {

$new_dir = VCARD_UPLOAD_PATH . $card_slug . '/';

if (!is_dir($new_dir)) {
            rename($upload_dir, $new_dir);
            $upload_dir = $new_dir;
        }
    }

/* ===============================
       PROFILE IMAGE UPLOAD
       =============================== */
    if (empty($error) && !empty($_FILES['profile_image']['name'])) {

// delete old image
        if ($profile_image && file_exists($upload_dir.$profile_image)) {
            unlink($upload_dir.$profile_image);
        }

$ext = strtolower(pathinfo($_FILES['profile_image']['name'], PATHINFO_EXTENSION));
        $profile_image = time().'_profile.'.$ext;

move_uploaded_file(
            $_FILES['profile_image']['tmp_name'],
            $upload_dir.$profile_image
        );
    }

/* ===============================
       UPDATE DATABASE
       =============================== */
    if (empty($error)) {

mysqli_query($conn, "
            UPDATE vcards SET
                company_id    = ".($company_id ? "'$company_id'" : "NULL").",
                card_slug     = '$card_slug',
                full_name     = '$full_name',
                designation   = '$designation',
                phone         = '$phone',
                email         = '$email',
                profile_image = ".($profile_image ? "'$profile_image'" : "NULL").",
                status        = '$status',
                updated_at    = NOW()
            WHERE id='$id'
        ");

header("Location: vcards_list.php?msg=VCard Updated Successfully");
        exit;
    }
}
?>

<div class="page-body">
<div class="container-fluid">
<div class="row">
<div class="col-sm-12">

<div class="card">
<div class="card-header pb-0 card-no-border">
    <h2>Edit VCard</h2>
</div>

<?php if (!empty($error)): ?>
<div class="alert alert-danger"><?= htmlspecialchars($error); ?></div>
<?php endif; ?>

<form method="POST" enctype="multipart/form-data">
<div class="row">
    

<div class="col-md-6 mb-3">
<label class="form-label">Select Company *</label>
<select name="company_id" class="form-control" required>
<?php
$vcards = mysqli_query($conn,"SELECT id, name FROM vcard_company WHERE status=1 ORDER BY name");
while ($v = mysqli_fetch_assoc($vcards)) {
    $sel = ($v['id'] == $row['vcard_id']) ? 'selected' : '';
    echo "<option value='{$v['id']}' $sel>".htmlspecialchars($v['name'])."</option>";
}
?>
</select>
</div>

<div class="col-md-6 mb-3">
<label class="form-label">Full Name *</label>
<input type="text" name="full_name" class="form-control"
       value="<?= htmlspecialchars($row['full_name']); ?>" required>
</div>

<div class="col-md-6 mb-3">
<label class="form-label">Designation</label>
<input type="text" name="designation" class="form-control"
       value="<?= htmlspecialchars($row['designation']); ?>">
</div>

<div class="col-md-6 mb-3">
<label class="form-label">Phone</label>
<input type="text" name="phone" class="form-control"
       value="<?= htmlspecialchars($row['phone']); ?>">
</div>

<div class="col-md-6 mb-3">
<label class="form-label">Email</label>
<input type="email" name="email" class="form-control"
       value="<?= htmlspecialchars($row['email']); ?>">
</div>

<div class="col-md-6 mb-3">
<label class="form-label">Card Slug *</label>
<input type="text" name="card_slug" class="form-control"
       value="<?= htmlspecialchars($row['card_slug']); ?>" required>
</div>

<div class="col-md-6 mb-3">
<label class="form-label">Profile Image</label>
<input type="file" name="profile_image" class="form-control">
<?php if ($row['profile_image']): ?>
    <div class="mt-2">
        <img src="uploads/vcard/<?= $row['card_slug']; ?>/<?= $row['profile_image']; ?>"
             style="height:60px;border-radius:8px;">
    </div>
<?php endif; ?>
</div>

<div class="col-md-6 mb-3">
    <label class="form-label">Status</label><br>
<label class="form-label">
    <input type="checkbox" name="status" <?= ($row['status']==1)?'checked':''; ?>>
    Active
</label>
</div>

</div>

<br>
<button type="submit" class="btn btn-success">Update VCard</button>
<a href="vcards_list.php" class="btn btn-secondary">Cancel</a>

</form>

</div>
</div>

</div>
</div>
</div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>