Zploit 0-Day Shell

:: Editing File: user_edit.php

<?php 
require_once 'db.php';
require_once 'session.php';
include "header.php";

// -------------------------------------------------------
// 1️⃣ Validate ID
// -------------------------------------------------------
if (!isset($_GET['id']) || empty($_GET['id'])) {
    $_SESSION['error'] = "Invalid request! User ID missing.";
    header("Location: user_list.php");
    exit;
}

$user_id = intval($_GET['id']);

// -------------------------------------------------------
// 2️⃣ Fetch User Data
// -------------------------------------------------------
$sql = "SELECT * FROM users WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $user_id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
$user = mysqli_fetch_assoc($result);
mysqli_stmt_close($stmt);

if (!$user) {
    $_SESSION['error'] = "User not found!";
    header("Location: user_list.php");
    exit;
}

// ⚠️ Do NOT close DB here (footer uses it)
?>

<div class="page-content-wrapper">

<div class="page-content">

<div class="page-breadcrumb d-none d-sm-flex align-items-center mb-3">
            <div class="breadcrumb-title pe-3">Users</div>
            <div class="ps-3">
                <nav aria-label="breadcrumb">
                    <ol class="breadcrumb mb-0 p-0 align-items-center">
                        <li class="breadcrumb-item">
                            <a href="dashboard.php"><ion-icon name="home-outline"></ion-icon></a>
                        </li>
                        <li class="breadcrumb-item active" aria-current="page">Edit User</li>
                    </ol>
                </nav>
            </div>
        </div>

<div class="mb-3 col-sm-6">
                            <label class="form-label">Email*</label>
                            <input type="email" class="form-control" name="email" 
                                   value="<?= htmlspecialchars($user['email']); ?>" required>
                        </div>

<div class="mb-3 col-sm-6">
                            <label class="form-label">Username*</label>
                            <input type="text" class="form-control" name="username" 
                                   value="<?= htmlspecialchars($user['username']); ?>" required>
                        </div>

<div class="mb-3 col-sm-6">
                            <label class="form-label">Occupation</label>
                            <input type="text" class="form-control" name="occupation"
                                   value="<?= htmlspecialchars($user['occupation']); ?>">
                        </div>

<div class="mb-3 col-sm-6">
                            <label class="form-label">Mobile Number*</label>
                            <input type="text" class="form-control" name="mobile_no"
                                   value="<?= htmlspecialchars($user['mobile_no']); ?>" required>
                        </div>

<div class="mb-3 col-sm-12">
                            <label class="form-label">Message</label>
                            <textarea class="form-control" name="message" rows="3"><?= htmlspecialchars($user['message']); ?></textarea>
                        </div>

<div class="mb-3 col-sm-6">
                            <label class="form-label">Payment Status</label>
                            <select class="form-control" name="is_paid">
                                <option value="0" <?= $user['is_paid'] == 0 ? 'selected' : ''; ?>>Unpaid</option>
                                <option value="1" <?= $user['is_paid'] == 1 ? 'selected' : ''; ?>>Paid</option>
                            </select>
                        </div>

<div class="mb-3 col-sm-6">
                            <label class="form-label">OTP</label>
                            <input type="text" class="form-control" name="otp"
                                   value="<?= htmlspecialchars($user['otp']); ?>">
                        </div>

<div class="mb-3 col-sm-12">
                            <label class="form-label">Payment Receipt Image</label>
                            <input type="file" class="form-control" name="payment_receipt_path" accept="image/*">

<?php if (!empty($user['payment_receipt_path'])): ?>
                                <small class="text-muted">
                                    Current Receipt:
                                    <a href="../uploads/receipts/<?= htmlspecialchars($user['payment_receipt_path']); ?>" target="_blank">
                                        View
                                    </a> | Upload new to replace
                                </small>
                            <?php else: ?>
                                <small class="text-muted">No receipt uploaded.</small>
                            <?php endif; ?>
                        </div>

<div class="col-12 mt-4">
                            <button type="submit" class="btn btn-primary">Update User</button>
                            <a href="user_list.php" class="btn btn-warning">Back to List</a>
                        </div>

</div>
                </form>

</div>
        </div>
    </div>
</div>

<?php include "footer.php"; ?>