Zploit 0-Day Shell

:: Editing File: login.php

<?php
include("db.php");

if(isset($_POST['username']))
{
    $username = mysqli_real_escape_string($conn,$_POST['username']);
    $password = md5($_POST['password']);

$sql = mysqli_query($conn,"
        SELECT *
        FROM admin_tbl
        WHERE
        (
            username='$username'
            OR
            email='$username'
            OR
            mobile='$username'
        )
        AND password='$password'
        AND status='Active'
        LIMIT 1
    ");

if(mysqli_num_rows($sql)>0)
    {
        $row = mysqli_fetch_assoc($sql);

$_SESSION['admin_id']      = $row['id'];
        $_SESSION['username']      = $row['username'];
        $_SESSION['email']         = $row['email'];
        $_SESSION['mobile']        = $row['mobile'];
        $_SESSION['pic']           = $row['pic'];
        $_SESSION['occupation']    = $row['occupation'];
        $_SESSION['role']          = $row['role'];
        $_SESSION['about_me']      = $row['about_me'];
        $_SESSION['status']        = $row['status'];

header("Location: dashboard.php");
        exit;

}
    else
    {
        header("Location: index.php?msg=invalid");
        exit;
    }
}
?>