Zploit 0-Day Shell

:: Editing File: user_delete.php

<?php
// user_delete.php

require_once 'db.php';
require_once 'session.php';

// 1. Validate ID
if (!isset($_GET['id']) || empty($_GET['id'])) {
    $_SESSION['error'] = "Error: User ID is missing for deletion.";
    header("Location: user_list.php");
    exit;
}

$user_id = (int)$_GET['id'];
$success = false;
$username = "Unknown User"; // Default

// Upload directory (same as update file)
$upload_dir = '../uploads/receipts/';

// 2. Start transaction
mysqli_begin_transaction($conn);

try {
    // Fetch user + old receipt file
    $old_receipt = null;
    $sql_fetch = "SELECT username, payment_receipt_path FROM users WHERE id = ?";
    $stmt_fetch = mysqli_prepare($conn, $sql_fetch);

if ($stmt_fetch) {
        mysqli_stmt_bind_param($stmt_fetch, "i", $user_id);
        mysqli_stmt_execute($stmt_fetch);
        mysqli_stmt_bind_result($stmt_fetch, $username, $old_receipt);
        mysqli_stmt_fetch($stmt_fetch);
        mysqli_stmt_close($stmt_fetch);
    }

// 3. DELETE query
    $sql_delete = "DELETE FROM users WHERE id = ?";
    $stmt_delete = mysqli_prepare($conn, $sql_delete);

if ($stmt_delete) {
        mysqli_stmt_bind_param($stmt_delete, "i", $user_id);

if (mysqli_stmt_execute($stmt_delete)) {
            mysqli_commit($conn);
            $success = true;
            mysqli_stmt_close($stmt_delete);
        } else {
            throw new Exception("Database execution error: " . mysqli_stmt_error($stmt_delete));
        }
    } else {
        throw new Exception("Database preparation error: " . mysqli_error($conn));
    }

} catch (Exception $e) {
    mysqli_rollback($conn);
    $_SESSION['error'] = "Failed to delete user: " . $e->getMessage();
    header("Location: user_list.php");
    exit;
}

// 4. Delete old receipt image (if exists)
if ($success) {

if (!empty($old_receipt)) {

$receipt_path = $upload_dir . basename($old_receipt);

if (file_exists($receipt_path) && is_file($receipt_path)) {
            @unlink($receipt_path); // delete quietly
        }
    }

$_SESSION['success'] = "User <strong>{$username}</strong> (ID: {$user_id}) deleted successfully. 🗑️";
    header("Location: user_list.php");
    exit;
}

mysqli_close($conn);
?>