Zploit 0-Day Shell

:: Editing File: domain_details_edit.php

<?php

ob_start();

include 'header.php';

$page_title = "Edit Clients Domain Details";
$page_parent = "Clients Domain";
$page_parent_link = "domain_details_list.php";

include 'breadcrumb.php';
include 'menu.php';

if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
  header("Location: domain_details_list.php?msg=Invalid ID");
  exit;
}

$id = intval($_GET['id']);
$result = mysqli_query($conn, "SELECT * FROM domain_details WHERE id = $id");
$domain = mysqli_fetch_assoc($result);

if (!$domain) {
  header("Location: domain_details_list.php?msg=Domain Not Found");
  exit;
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  $client_id = mysqli_real_escape_string($conn, $_POST['client_id']);
  $start_date = mysqli_real_escape_string($conn, $_POST['start_date']);
  $expiry_date = mysqli_real_escape_string($conn, $_POST['expiry_date']);
  $amount = mysqli_real_escape_string($conn, $_POST['amount']);
  $notes = mysqli_real_escape_string($conn, $_POST['notes']);
  $comments = mysqli_real_escape_string($conn, $_POST['comments']);

$sql = "UPDATE domain_details SET 
            client_id='$client_id',
            start_date='$start_date',
            expiry_date='$expiry_date',
            amount='$amount',
            notes='$notes',
            comments='$comments',
            updated_at=NOW()
          WHERE id=$id";

if (mysqli_query($conn, $sql)) {
    header("Location: domain_details_list.php?msg=Domain Updated Successfully");
    exit;
  } else {
    $message = "Database Error: " . mysqli_error($conn);
  }
}
?>

<div class="page-body">
  <div class="container-fluid">
    <div class="card">
      <div class="card-header pb-0">
        <h2>Edit Domain Details</h2>
      </div>
      <div class="card-body">
        <form method="POST">
          <div class="row g-3">
            <div class="col-md-6">
              <label class="form-label">Client Name</label>
              <select name="client_id" class="form-select" required>
                <?php
                $clients = mysqli_query($conn, "SELECT id, name FROM clients ORDER BY name ASC");
                while ($c = mysqli_fetch_assoc($clients)) {
                  $selected = ($c['id'] == $domain['client_id']) ? 'selected' : '';
                  echo "<option value='{$c['id']}' $selected>{$c['name']}</option>";
                }
                ?>
              </select>
            </div>

<div class="col-md-6">
              <label class="form-label">Start Date</label>
              <input type="date" name="start_date" class="form-control" value="<?= $domain['start_date'] ?>">
            </div>

<div class="col-md-6">
              <label class="form-label">Expiry Date</label>
              <input type="date" name="expiry_date" class="form-control" value="<?= $domain['expiry_date'] ?>">
            </div>

<div class="col-md-6">
              <label class="form-label">Amount (₹)</label>
              <input type="number" name="amount" class="form-control" value="<?= $domain['amount'] ?>">
            </div>

<div class="col-md-6">
              <label class="form-label">Notes</label>
              <textarea name="notes" class="form-control"><?= $domain['notes'] ?></textarea>
            </div>

<div class="col-md-6">
              <label class="form-label">Comments</label>
              <textarea name="comments" class="form-control"><?= $domain['comments'] ?></textarea>
            </div>
          </div>

<div class="mt-4">
            <button type="submit" class="btn btn-success">Update</button>
            <a href="domain_details_list.php" class="btn btn-secondary">Cancel</a>
          </div>
        </form>
      </div>
    </div>
  </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>