Zploit 0-Day Shell

:: Editing File: qestimations_edit.php

<?php
ob_start();
include 'header.php';
$page_title = "Edit Estimation";
include 'breadcrumb.php';
include 'menu.php';

/* ===== Validate ID ===== */
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    header("Location: qestimations_list.php?msg=Invalid Request");
    exit;
}

$id = intval($_GET['id']);

/* ===== Fetch Existing Estimation ===== */
$query = mysqli_query($conn, "SELECT * FROM quotation_estimations WHERE id = $id");
$estimation = mysqli_fetch_assoc($query);

if (!$estimation) {
    header("Location: qestimations_list.php?msg=Estimation Not Found");
    exit;
}

$message = "";

/* ===== Handle Form Submit ===== */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    
    $c_id = intval($_POST['c_id']);
    
    
    $quotation_id = intval($_POST['quotation_id']);
    $description  = mysqli_real_escape_string($conn, $_POST['description']);
    $area         = mysqli_real_escape_string($conn, $_POST['area']);
    $amount       = floatval($_POST['amount']);
    $status       = isset($_POST['status']) ? intval($_POST['status']) : 1;

if ($quotation_id > 0 && !empty($description) && $amount > 0) {

$sql = "UPDATE qestimation SET
                    c_id         = '$c_id',
                    quotation_id = '$quotation_id',
                    description  = '$description',
                    area         = '$area',
                    amount       = '$amount',
                    status       = '$status',
                    updated_at   = NOW()
                WHERE id = $id";

if (mysqli_query($conn, $sql)) {
            header("Location: qestimations_list.php?msg=Estimation Updated Successfully");
            exit;
        } else {
            $message = "Database Error: " . mysqli_error($conn);
        }

} else {
        $message = "Please fill all required fields.";
    }
}
?>

<div class="page-body">
  <div class="container-fluid">
    <div class="card">
      <div class="card-header pb-0">
        <h2>Edit Estimation</h2>
      </div>

<form method="POST">
          <div class="row g-3">
            
                        
            <div class="col-md-12">
              <label class="form-label">Client</label>
              <select name="c_id" class="form-control" required>
                <option value="">-- Select Client --</option>
                <?php
                $cat_sql = "SELECT id, client_name FROM quotations where status = 1 ORDER BY client_name ASC";
                $cat_res = mysqli_query($conn, $cat_sql);

while ($cat = mysqli_fetch_assoc($cat_res)) {
                    $selected = ($cat['id'] == $estimation['c_id']) ? "selected" : "";
                    echo "<option value='{$cat['id']}' {$selected}>{$cat['client_name']}</option>";
                }
                ?>
              </select>
            </div>

<div class="col-md-6">
              <label class="form-label">Description</label>
              <input type="text" name="description"
                     value="<?= htmlspecialchars($estimation['description']); ?>"
                     class="form-control" required>
            </div>
            
            
            <div class="col-md-6">
              <label class="form-label">Area / Specification</label>
              <input type="text" name="area"
                     value="<?= htmlspecialchars($estimation['area']); ?>"
                     class="form-control" required>
            </div>
            
            
            <div class="col-md-6">
              <label class="form-label">Amount(₹)</label>
              <input type="number" name="amount"
                     value="<?= htmlspecialchars($estimation['amount']); ?>"
                     class="form-control" required>
            </div>

<div class="col-md-6">
              <label class="form-label">Status</label>
              <select name="status" class="form-select">
                <option value="1" <?= $estimation['status']==1?'selected':''; ?>>Active</option>
                <option value="0" <?= $estimation['status']==0?'selected':''; ?>>Inactive</option>
              </select>
            </div>

</div>

<div class="mt-4">
            <button type="submit" class="btn btn-success">Update</button>
            <a href="qestimations_list.php" class="btn btn-secondary">Cancel</a>
          </div>
        </form>

</div>
    </div>
  </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>