Zploit 0-Day Shell

:: Editing File: gallery_delete.php

<?php
// gallery_delete.php

require_once 'db.php';
require_once 'session.php';

// 1️⃣ Validate ID
if (!isset($_GET['id']) || empty($_GET['id'])) {
    $_SESSION['error'] = "Error: Gallery ID missing.";
    header("Location: gallery.php");
    exit;
}

$gallery_id = (int)$_GET['id'];
$success = false;

$upload_dir = '../uploads/gallery/';  // gallery folder
$old_image = null;

// Start transaction
mysqli_begin_transaction($conn);

try {

// 2️⃣ Get Image Before Delete
    $sql_fetch = "SELECT image FROM gallery WHERE id = ?";
    $stmt_fetch = mysqli_prepare($conn, $sql_fetch);

if ($stmt_fetch) {
        mysqli_stmt_bind_param($stmt_fetch, "i", $gallery_id);
        mysqli_stmt_execute($stmt_fetch);
        mysqli_stmt_bind_result($stmt_fetch, $old_image);
        mysqli_stmt_fetch($stmt_fetch);
        mysqli_stmt_close($stmt_fetch);
    }

// 3️⃣ Delete Gallery Row
    $sql_delete = "DELETE FROM gallery WHERE id = ?";
    $stmt_delete = mysqli_prepare($conn, $sql_delete);

if ($stmt_delete) {
        mysqli_stmt_bind_param($stmt_delete, "i", $gallery_id);

if (mysqli_stmt_execute($stmt_delete)) {
            mysqli_commit($conn);   // success
            $success = true;
        } else {
            throw new Exception("DB execution error: " . mysqli_stmt_error($stmt_delete));
        }

mysqli_stmt_close($stmt_delete);
    } else {
        throw new Exception("DB prepare error: " . mysqli_error($conn));
    }

} catch (Exception $e) {
    mysqli_rollback($conn);
    $_SESSION['error'] = "Failed to delete gallery: " . $e->getMessage();
    header("Location: gallery.php");
    exit;
}

// 4️⃣ Delete Image If Exists
if ($success && !empty($old_image)) {
    $image_file = $upload_dir . $old_image;

if (file_exists($image_file) && is_file($image_file)) {
        unlink($image_file); // delete file
    }
}

$_SESSION['success'] = "🗑️ Gallery image deleted successfully!";
header("Location: gallery.php");
exit;