Zploit 0-Day Shell

:: Editing File: category_delete.php

<?php
// category_delete.php

require_once 'db.php'; 
require_once 'session.php';

// 1. Validate ID from URL
if (!isset($_GET['id']) || empty($_GET['id'])) {
    $_SESSION['error'] = "Error: Category ID is missing for deletion.";
    header("Location: category.php"); 
    exit;
}

$category_id = (int)$_GET['id'];
$success = false;
$category_name = "Unknown Category"; // Default name for feedback

// Start a transaction for safety (optional but good practice)
mysqli_begin_transaction($conn);

try {
    // 2. Fetch the current image path before deletion
    $old_image_path = null;
    $sql_fetch = "SELECT name, image FROM collectiongroups WHERE id = ?";
    $stmt_fetch = mysqli_prepare($conn, $sql_fetch);
    
    if ($stmt_fetch) {
        mysqli_stmt_bind_param($stmt_fetch, "i", $category_id);
        mysqli_stmt_execute($stmt_fetch);
        mysqli_stmt_bind_result($stmt_fetch, $category_name, $old_image_path);
        mysqli_stmt_fetch($stmt_fetch);
        mysqli_stmt_close($stmt_fetch);
    }

// 3. Prepare and Execute DELETE Query
    $sql_delete = "DELETE FROM collectiongroups WHERE id = ?";
    $stmt_delete = mysqli_prepare($conn, $sql_delete);

if ($stmt_delete) {
        mysqli_stmt_bind_param($stmt_delete, "i", $category_id);
        
        if (mysqli_stmt_execute($stmt_delete)) {
            // Commit the deletion from the database
            mysqli_commit($conn);
            $success = true;
            mysqli_stmt_close($stmt_delete);
        } else {
            throw new Exception("Database execution error: " . mysqli_stmt_error($stmt_delete));
        }
    } else {
        throw new Exception("Database preparation error: " . mysqli_error($conn));
    }

} catch (Exception $e) {
    // Rollback changes if anything failed
    mysqli_rollback($conn);
    $_SESSION['error'] = "Failed to delete category: " . $e->getMessage();
    header("Location: category.php");
    exit;
}

// 4. Delete File from Server (Only if database deletion was successful)
if ($success) {
    if ($old_image_path && file_exists($old_image_path) && is_file($old_image_path)) {
        if (unlink($old_image_path)) {
            // File deleted successfully (no action needed, just logging if necessary)
        } else {
            // Log that the file deletion failed, but the DB record is gone.
            // This is a warning, not a critical failure that stops the user.
        }
    }

$_SESSION['success'] = "Category **'{$category_name}'** (ID: {$category_id}) deleted successfully.🗑️";
    header("Location: category.php");
    exit;
}

mysqli_close($conn);