Zploit 0-Day Shell

:: Editing File: index.php

<?php
session_start();
include('config/db.php');

$message = '';

if (isset($_POST['login'])) {
    $email = trim($_POST['email']);
    $password = trim($_POST['password']);
    $hashed = md5($password); // For demo; use password_hash() in production

$sql = "SELECT * FROM users WHERE email = ? AND password = ?";
    $stmt = $conn->prepare($sql);
    $stmt->bind_param("ss", $email, $hashed);
    $stmt->execute();
    $result = $stmt->get_result();

if ($result->num_rows == 1) {
        $user = $result->fetch_assoc();

$_SESSION['user_id'] = $user['id'];
        $_SESSION['user_name'] = $user['name'];
        $_SESSION['user_role'] = $user['role'];

// Redirect based on role
        if ($user['role'] == 'admin') {
            //header("Location: admin/dashboard.php");
			header("Location: dashboard.php");
        } else {
            //header("Location: user/dashboard.php");
			header("Location: dashboard.php");
        }
        exit();
    } else {
        $message = "❌ Invalid Email or Password!";
    }
}
?>

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta name="description" content="We offer expert digital marketing, website development, graphic design, and software solutions to grow your business.">
    <meta name="keywords" content="Kreative Pixelz, Digital marketing, Webisite development, Graphics designing, CRM & Web development company">
    <meta name="author" content="Kreative Pixelz">
    <link rel="icon" href="assets/images/favicon.png" type="image/x-icon">
    <link rel="shortcut icon" href="assets/images/favicon.png" type="image/x-icon">
    <title>CRM Admin - Kreative Pixelz Digital Marketing, Web Development & Design Agency</title>
    
    <link rel="preconnect" href="https://fonts.googleapis.com">
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin="">
    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&amp;family=Nunito+Sans:ital,wght@0,300;0,400;0,700;0,800;0,900;1,700&amp;display=swap" rel="stylesheet">
    
    <link rel="stylesheet" type="text/css" href="assets/css/font-awesome.css">
    
    <link rel="stylesheet" type="text/css" href="assets/css/vendors/icofont.css">
    
    <link rel="stylesheet" type="text/css" href="assets/css/vendors/themify.css">
    
    <link rel="stylesheet" type="text/css" href="assets/css/vendors/flag-icon.css">
    
    <link rel="stylesheet" type="text/css" href="assets/css/vendors/feather-icon.css">
    
    
    
    <link rel="stylesheet" type="text/css" href="assets/css/vendors/bootstrap.css">
    
    <link rel="stylesheet" type="text/css" href="assets/css/style.css">
    
    <link rel="stylesheet" type="text/css" href="assets/css/responsive.css">
  </head>
  <body>
    
    <div class="container-fluid p-0">
      <div class="row m-0">
        <div class="col-12 p-0">    
          <div class="login-card login-dark" style="background: url(logo/login_bg.png);background-size: cover !important;">
            <div>
              <div><a class="logo" href="index.php">
			  <img class="img-fluid for-light" src="assets/images/logo/logo.png" alt="looginpage" style="height: 100px;">
			  <img class="img-fluid for-dark" src="assets/images/logo/logo_dark.png" alt="looginpage" style="height: 100px;"></a>
			  </div>
              <div class="login-main"> 
				
				<?php if ($message): ?>
					<div class="alert alert-danger text-center py-2"><?= $message ?></div>
				<?php endif; ?>
						
                <form class="theme-form" method="POST">
                  <h2>Kreative Pixelz CRM Login</h2>
                  <p class="f-m-light mt-1">Enter your email & password to login</p>
                  <div class="form-group">
                    <label class="col-form-label">Username</label>
                    <input class="form-control" type="text" required="" placeholder="" name="email">
                  </div>
                  <div class="form-group">
                    <label class="col-form-label">Password</label>
                    <div class="form-input position-relative">
                      <input class="form-control" type="password" name="password"  required="" placeholder="*********">
                      
                    </div>
                  </div>
                  <div class="form-group mb-0">
					
					<br>
                    <div class="text-end mt-3">
                      <button class="btn btn-primary btn-block w-100" name="login" type="submit">Sign in</button>
                    </div>
                  </div>
                
				</form>
				<br>
				<div class="card-footer text-center text-muted">
					<small>&copy; <?= date("Y") ?> Kreative Pixelz</small>
				</div>
					
              </div>
            </div>
          </div>
        </div>
      </div>
      
      <script src="assets/js/jquery.min.js"></script>
      
      <script src="assets/js/bootstrap/bootstrap.bundle.min.js"></script>
      
      <script src="assets/js/icons/feather-icon/feather.min.js"></script>
      <script src="assets/js/icons/feather-icon/feather-icon.js"></script>
      
      
      <script src="assets/js/config.js"></script>
      
      
      
      <script src="assets/js/script.js"></script>
    </div>
  </body>
</html>