Zploit 0-Day Shell

:: Editing File: qcategory_edit.php

<?php
ob_start();

include 'header.php';
$page_title = "Edit Quotation Category";
include 'breadcrumb.php';
include 'menu.php';

// ✅ Validate ID
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    header("Location: qcategory_list.php?msg=Invalid Request");
    exit;
}

$id = intval($_GET['id']);

// ✅ Fetch Category
$query = mysqli_query($conn, "SELECT * FROM quotation_categories WHERE id = $id");
$category = mysqli_fetch_assoc($query);

if (!$category) {
    header("Location: qcategory_list.php?msg=Category Not Found");
    exit;
}

$message = "";

// ✅ Update Category
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $name   = mysqli_real_escape_string($conn, $_POST['name']);
    $status = intval($_POST['status']);

if (!empty($name)) {
        $sql = "UPDATE quotation_categories 
                SET name = '$name',
                    status = '$status',
                    updated_at = NOW()
                WHERE id = $id";

if (mysqli_query($conn, $sql)) {
            header("Location: qcategory_list.php?msg=Category Updated Successfully");
            exit;
        } else {
            $message = "Database Error: " . mysqli_error($conn);
        }
    } else {
        $message = "Category name is required.";
    }
}
?>

<div class="card-header pb-0">
        <h2>Edit Quotation Category</h2>
      </div>

<?php if ($message): ?>
          <div class="alert alert-danger"><?= $message; ?></div>
        <?php endif; ?>

<div class="col-md-6">
              <label class="form-label">Category Name</label>
              <input type="text"
                     name="name"
                     value="<?= htmlspecialchars($category['name']); ?>"
                     class="form-control"
                     required>
            </div>

<div class="col-md-6">
              <label class="form-label">Status</label>
              <select name="status" class="form-control">
                <option value="1" <?= $category['status'] == 1 ? 'selected' : ''; ?>>Active</option>
                <option value="0" <?= $category['status'] == 0 ? 'selected' : ''; ?>>Inactive</option>
              </select>
            </div>

</div>

<div class="mt-4">
            <button type="submit" class="btn btn-success">Update</button>
            <a href="qcategory_list.php" class="btn btn-secondary">Cancel</a>
          </div>

</form>
      </div>
    </div>
  </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>