Zploit 0-Day Shell

:: Editing File: vcard_portfolio_add.php

<?php
ob_start();
include 'header.php';

$page_title = "Add VCard Portfolio";
$page_parent = "VCards";
$page_parent_link = "vcard_portfolio_list.php";

include 'breadcrumb.php';
include 'menu.php';

$message = "";

/* ===============================
   PATH CONFIG
   =============================== */
define('VCARD_UPLOAD_PATH', $_SERVER['DOCUMENT_ROOT'] . '/kreativecrm/uploads/vcard/');

/* ===============================
   FORM SUBMIT
   =============================== */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$vcard_id   = intval($_POST['vcard_id']);
    $title      = mysqli_real_escape_string($conn, $_POST['title']);
    $description= mysqli_real_escape_string($conn, $_POST['description']);
    $sort_order = intval($_POST['sort_order']);
    $status     = isset($_POST['status']) ? 1 : 0;

/* ===============================
       FETCH VCARD SLUG
       =============================== */
    if ($message == '') {
        $vcard_q = mysqli_query(
            $conn,
            "SELECT card_slug FROM vcards WHERE id='$vcard_id'"
        );
        $vcard = mysqli_fetch_assoc($vcard_q);

if (!$vcard) {
            $message = "Invalid VCard selected.";
        }
    }

/* ===============================
       PORTFOLIO DIRECTORY
       =============================== */
    if ($message == '') {
        $slug = $vcard['card_slug'];
        $upload_dir = VCARD_UPLOAD_PATH . $slug . '/portfolio/';

if (!is_dir($upload_dir)) {
            mkdir($upload_dir, 0777, true);
        }
    }

/* ===============================
       IMAGE UPLOAD
       =============================== */
    $image = NULL;
    $allowed_ext = ['jpg','jpeg','png','webp'];

if ($message == '' && !empty($_FILES['image']['name'])) {

$ext = strtolower(pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION));

if (!in_array($ext, $allowed_ext)) {
            $message = "Only JPG, PNG, WEBP images allowed.";
        } else {

$image = time() . '_portfolio.' . $ext;

move_uploaded_file(
                $_FILES['image']['tmp_name'],
                $upload_dir . $image
            );
        }
    }

/* ===============================
       INSERT DATABASE
       =============================== */
    if ($message == '') {

$sql = "INSERT INTO vcard_portfolio
                (vcard_id, image, title, description, sort_order, status, created_at)
                VALUES
                ('$vcard_id', '$image', '$title', '$description', '$sort_order', '$status', NOW())";

if (mysqli_query($conn, $sql)) {
            header("Location: vcard_portfolio_list.php?msg=Portfolio added successfully");
            exit;
        } else {
            $message = "Database Error: " . mysqli_error($conn);
        }
    }
}
?>

<div class="page-body">
<div class="container-fluid">
<div class="row">
<div class="col-sm-12">

<div class="card">
<div class="card-header pb-0 card-no-border">
    <h2>Add VCard Portfolio</h2>
</div>

<?php if ($message): ?>
<div class="alert alert-danger"><?= htmlspecialchars($message); ?></div>
<?php endif; ?>

<div class="col-md-6">
<label class="form-label">Select VCard *</label>
<select name="vcard_id" class="form-control" required>
<option value="">-- Select VCard --</option>
<?php
$vcards = mysqli_query(
    $conn,
    "SELECT id, full_name FROM vcards WHERE status=1 ORDER BY full_name"
);
while ($v = mysqli_fetch_assoc($vcards)) {
    echo "<option value='{$v['id']}'>" . htmlspecialchars($v['full_name']) . "</option>";
}
?>
</select>
</div>

<div class="col-md-6">
<label class="form-label">Title </label>
<input type="text" name="title" class="form-control" >
</div>

<div class="col-md-12 mt-3">
<label class="form-label">Description</label>
<textarea name="description" class="form-control" rows="4"></textarea>
</div>

<div class="col-md-6 mt-3">
<label class="form-label">Portfolio Image</label>
<input type="file" name="image" class="form-control">
<small class="text-muted">JPG, PNG, WEBP</small>
</div>

<div class="col-md-3 mt-3">
<label class="form-label">Sort Order</label>
<input type="number" name="sort_order" class="form-control" value="0">
</div>

<div class="col-md-3 mt-3">
<label class="form-label">Status</label><br>
<input type="checkbox" name="status" checked> Active
</div>

</div>

<br>
<button type="submit" class="btn btn-success">Save Portfolio</button>
<a href="vcard_portfolio_list.php" class="btn btn-secondary">Cancel</a>

</form>

</div>
</div>

</div>
</div>
</div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>