Zploit 0-Day Shell

:: Editing File: user_list.php

<?php 
require_once 'db.php'; 
require_once 'session.php'; 
include "header.php";

$status  = $_GET['status'] ?? '';
$message = htmlspecialchars($_GET['msg'] ?? '');

$users = [];

// Fetch user table data
$sql = "SELECT id, email, username, occupation, mobile_no, message,
               is_paid, otp, otp_expiry, created_at, last_txn_ref, payment_receipt_path
        FROM users 
        ORDER BY id DESC";

$stmt = mysqli_prepare($conn, $sql);

if ($stmt) {
    mysqli_stmt_execute($stmt);
    $result = mysqli_stmt_get_result($stmt);
    if ($result && mysqli_num_rows($result) > 0) {
        while ($row = mysqli_fetch_assoc($result)) {
            $users[] = $row;
        }
    }
    mysqli_stmt_close($stmt);
} else {
    $status = 'danger';
    $message = 'Database query failed: ' . mysqli_error($conn);
}

mysqli_close($conn);
?>

<div class="page-breadcrumb d-none d-sm-flex align-items-center mb-3">
      <div class="breadcrumb-title pe-3">Users</div>
      <div class="ps-3">
        <nav aria-label="breadcrumb">
          <ol class="breadcrumb mb-0 p-0 align-items-center">
            <li class="breadcrumb-item"><a href="dashboard.php"><ion-icon name="home-outline"></ion-icon></a></li>
            <li class="breadcrumb-item active" aria-current="page">User List</li>
          </ol>
        </nav>
      </div>
    </div>

<div class="row mb-3">
          <div class="col-sm-9">
            <h5 class="mb-0">User List</h5>
          </div>
          <div class="col-sm-3 text-end">
            <a href="user_add.php" class="btn btn-primary">Add User</a>
          </div>
        </div>

<?php if ($status === 'success'): ?>
          <div class="alert alert-success alert-dismissible fade show">
            <strong>Success!</strong> <?= $message ?>
            <button class="btn-close" data-bs-dismiss="alert"></button>
          </div>
        <?php elseif ($status === 'danger'): ?>
          <div class="alert alert-danger alert-dismissible fade show">
            <strong>Error!</strong> <?= $message ?>
            <button class="btn-close" data-bs-dismiss="alert"></button>
          </div>
        <?php endif; ?>

<div class="table-responsive mt-3">
          <table class="table align-middle" id="example">
            <thead class="table-secondary">
              <tr>
                <th>Sr No</th>
               
                <th>Email</th>
                <th>Username</th>
                <th>Mobile</th>
                <th>Occupation</th>
                <th>Paid</th>
                <th>OTP</th>
				<th>Receipt</th>
                
                <th>Created</th>
               
			    <th class="text-center">Action</th>
              </tr>
            </thead>

<tbody>
              <?php if (empty($users)): ?>
                <tr>
                  <td colspan="11" class="text-center">No users found.</td>
                </tr>
              <?php else: ?>
                <?php $sr = 1; foreach ($users as $u): ?>
                  <tr>
                    <td><?= $sr++ ?></td>

<td>
                      <?= ($u['is_paid'] == 1) 
                          ? "<span class='badge bg-success'>Paid</span>" 
                          : "<span class='badge bg-danger'>Unpaid</span>" ?>
                    </td>

<td><?= htmlspecialchars($u['otp']) ?></td>
					
					 
                    <td>
                      <?php 
                        $img = (!empty($u['payment_receipt_path'])) 
                               ? "../uploads/receipt/" . $u['payment_receipt_path'] 
                               : "assets/images/placeholder.jpg";
                      ?>
                      <img src="<?= $img ?>" style="width:50px; height:50px; object-fit:cover;" class="rounded-3">
                    </td>
					
                   
                    <td><?= htmlspecialchars($u['created_at']) ?></td>
                    
					
					<td class="text-center">
                      <div class="d-flex justify-content-center align-items-center gap-3">
                        <a href="user_edit.php?id=<?= $u['id'] ?>" title="Edit">
                          <ion-icon name="create-outline"></ion-icon>
                        </a>
                        <a href="user_delete.php?id=<?= $u['id'] ?>" 
                           onclick="return confirm('Are you sure you want to delete this category?')" 
                           title="Delete" class="text-danger">
                          <ion-icon name="trash-outline"></ion-icon>
                        </a>
                      </div>
                    </td>
					
                  </tr>
                <?php endforeach; ?>
              <?php endif; ?>
            </tbody>
          </table>
        </div>

</div>
    </div>

<?php include "footer.php"; ?>

<script src="assets/plugins/datatable/js/jquery.dataTables.min.js"></script>
<script src="assets/plugins/datatable/js/dataTables.bootstrap5.min.js"></script>
<script src="assets/js/table-datatable.js"></script>