Zploit 0-Day Shell

:: Editing File: invoice_sahre.php

<?php
ob_start();
include 'header.php';

// Page meta
$page_parent = "Invoice CRM";
$page_parent_link = "invoice.php";
$page_title = "Share Invoice";
include 'breadcrumb.php';
include 'menu.php';

echo "invoice_send";
die;

// require invoice id
if (!isset($_GET['id']) || empty($_GET['id'])) {
    header("Location: invoice.php?msg=Invalid Request");
    exit;
}
$id = intval($_GET['id']);

// fetch invoice + client
$sql = "SELECT inv.*, c.name AS client_name, c.contact AS client_contact, c.mobile AS client_mobile
        FROM invoices inv
        LEFT JOIN clients c ON c.id = inv.client_id
        WHERE inv.id = " . intval($id) . "
        LIMIT 1";
$res = mysqli_query($conn, $sql);
$invoice = mysqli_fetch_assoc($res);

if (!$invoice) {
    header("Location: invoice.php?msg=Invoice not found");
    exit;
}

// build base url for public image link (similar to your portfolio approach)
$scheme = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') ? 'https' : 'http';
$base_dir = rtrim(dirname($_SERVER['SCRIPT_NAME']), '/') . '/';
$base_url = $scheme . '://' . $_SERVER['HTTP_HOST'] . $base_dir;

// if invoice pdf_path contains an image file, build URL
$invoice_image_url = '';
if (!empty($invoice['pdf_path'])) {
    // If pdf_path is already a full URL, use it. Otherwise prepend base_url.
    if (filter_var($invoice['pdf_path'], FILTER_VALIDATE_URL)) {
        $invoice_image_url = $invoice['pdf_path'];
    } else {
        // ensure no leading slash duplication
        $clean = ltrim($invoice['pdf_path'], '/');
        $invoice_image_url = $base_url . $clean;
    }
}

// pick phone to prefill: prefer client_mobile then client_contact then empty
$prefill_mobile = '';
if (!empty($invoice['client_mobile'])) $prefill_mobile = $invoice['client_mobile'];
elseif (!empty($invoice['client_contact'])) $prefill_mobile = $invoice['client_contact'];

// sanitize a bit for display
$invoice_no = htmlspecialchars($invoice['invoice_no']);
$client_name = htmlspecialchars($invoice['client_name']);
$grand_total = number_format((float)$invoice['grand_total'], 2);
$balance = number_format((float)$invoice['balance'], 2);
?>

<div class="page-body">
  <div class="container-fluid">
    <div class="row">
      <div class="col-sm-12">
        <div class="card">
          <div class="card-header"><h2>Share Invoice</h2></div>
          <div class="card-body">
            <form id="shareForm" method="POST" onsubmit="return false;">
              <div class="row">
                <div class="col-md-6">
                  <label class="form-label">Mobile Number</label>
                  <input type="text" id="mobile" name="mobile" class="form-control" placeholder="Enter WhatsApp number (include country code e.g. 91XXXXXXXXXX)" value="<?= htmlspecialchars($prefill_mobile) ?>">
                  <small class="text-muted">Format: country code + number (e.g. 91XXXXXXXXXX). If you don't include country code, WhatsApp may not work.</small>
                </div>

<div class="col-md-6">
                  <label class="form-label">Invoice No</label>
                  <input type="text" readonly class="form-control" value="<?= $invoice_no ?>">
                </div>

<div class="col-md-6 mt-3">
                  <label class="form-label">Client</label>
                  <input type="text" readonly class="form-control" value="<?= $client_name ?>">
                </div>

<!--<div class="col-md-3 mt-3">
                  <label class="form-label">Total</label>
                  <input type="text" readonly class="form-control" value="₹<?= $grand_total ?>">
                </div>

<div class="col-md-3 mt-3">
                  <label class="form-label">Remaining</label>
                  <input type="text" readonly class="form-control" value="₹<?= $balance ?>">
                </div>
-->

<div class="col-md-12 mt-4">
                  <label class="form-label">Invoice Preview</label>
                  <?php if (!empty($invoice_image_url)): ?>
                    <div class="mt-2">
                      <a href="<?= htmlspecialchars($invoice_image_url, ENT_QUOTES) ?>" target="_blank">
                        <img src="<?= htmlspecialchars($invoice_image_url, ENT_QUOTES) ?>" alt="Invoice Image" style="max-width:300px; border:1px solid #ccc; padding:6px; background:#fff;">
                      </a>
                    </div>
                    <input type="text" id="media_link" class="form-control mt-2" value="<?= htmlspecialchars($invoice_image_url, ENT_QUOTES) ?>" readonly>
                  <?php else: ?>
                    <div class="mt-2">
                      <div class="alert alert-warning">No invoice image found for this invoice.</div>
                    </div>
                    <input type="text" id="media_link" class="form-control mt-2" value="No media available" readonly>
                  <?php endif; ?>
                </div>

</div>

<br><br>
              <div class="text-center">
                <button type="button" id="whatsapp-send" class="btn btn-success" style="background:#00d757;border:none;">
                  <i class="fa fa-whatsapp"></i> Send Invoice on WhatsApp
                </button>
                <a href="invoice.php" class="btn btn-secondary">Back</a>
              </div>
            </form>
          </div>
        </div>
      </div>
    </div>
  </div>
</div>

<script>
document.getElementById('whatsapp-send').addEventListener('click', function () {
    const mobileRaw = document.getElementById('mobile').value.trim();
    const mediaLink = document.getElementById('media_link') ? document.getElementById('media_link').value.trim() : '';
    if (!mobileRaw) {
        alert('Please enter mobile number.');
        return;
    }

// sanitize mobile
    let mobile = mobileRaw.replace(/[\s+()-]/g, '');
    // remove leading zeros if any
    mobile = mobile.replace(/^0+/, '');

// Build message text
    let message  = "Hello " + <?= json_encode($client_name) ?> + ",%0A%0A";
    message += "This is Kreative Pixelz - here is your invoice details.%0A";
    message += "Invoice No: " + <?= json_encode($invoice_no) ?> + "%0A";

if (mediaLink && mediaLink !== "No media available") {
        message += "Invoice Link: " + mediaLink + "%0A%0A";
    }

message += "Please let us know if you have any questions.%0A\nThank you.";

const whatsappURL = `https://wa.me/${mobile}?text=${message}`;
    window.open(whatsappURL, '_blank');
});
</script>

<?php include 'footer.php'; ob_end_flush(); ?>