Zploit 0-Day Shell

:: Editing File: lead_crud_processor.php

<?php
ini_set('display_errors',1);
error_reporting(E_ALL);

include("session.php");

/* ---------- AJAX HANDLING BLOCK AT THE VERY TOP OF FILE ---------- */

if (isset($_POST['update_lead_fields'])) 
{
    // Clear any previous spaces/errors accidentally printed by other includes
    if (ob_get_length()) ob_clean(); 
    
    header("Content-Type: application/json");

$lead_id = intval($_POST['lead_id']);

if (isset($_POST['lead_note'])) 
    {
        $note = mysqli_real_escape_string($conn, $_POST['lead_note']);
         $sql = "UPDATE leads SET lead_note='$note' WHERE id='$lead_id'";
    } 
    elseif (isset($_POST['description'])) 
    {
        $desc = mysqli_real_escape_string($conn, $_POST['description']);
         $sql = "UPDATE leads SET description='$desc' WHERE id='$lead_id'";
    } 
    else 
    {
        echo json_encode([
            "status" => "error",
            "message" => "No field supplied."
        ]);
        exit; // Terminate execution
    }

if (mysqli_query($conn, $sql)) 
    {
        echo json_encode([
            "status" => "success",
            "message" => "Updated Successfully"
        ]);
    } 
    else 
    {
        echo json_encode([
            "status" => "error",
            "message" => mysqli_error($conn)
        ]);
    }

exit; // Crucial: Ensures absolutely nothing else on this page runs!
}

function executeJioDLTNotificationSMS($recipient_phone, $message_text) {
    $apiKey = "YOUR_FAST2SMS_API_KEY"; 
    $recipient_phone = preg_replace('/[^0-9]/', '', $recipient_phone);
    if(strlen($recipient_phone) == 12 && substr($recipient_phone, 0, 2) == "91") {
        $recipient_phone = substr($recipient_phone, 2);
    }
    if (strlen($recipient_phone) !== 10) return false;

$fields = array(
        "sender_id" => "YOUR_JIO_APPROVED_HEADER", 
        "message" => $message_text,
        "route" => "dlt", 
        "numbers" => $recipient_phone
    );

$curl = curl_init();
    curl_setopt_array($curl, array(
        CURLOPT_URL => "https://www.fast2sms.com/dev/bulkV2",
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_CUSTOMREQUEST => "POST",
        CURLOPT_POSTFIELDS => json_encode($fields),
        CURLOPT_HTTPHEADER => array("authorization: " . $apiKey, "accept: */*", "content-type: application/json"),
    ));
    $response = curl_exec($curl);
    $err = curl_error($curl);
    curl_close($curl);
    return !$err;
}

function broadcastDualCommunications($conn, $lead_id, $stage_id, $trigger_event_type) {
    $operator_id = $_SESSION['user_id'] ?? 1;
    $lead_res = mysqli_query($conn, "SELECT l.*, s.name as current_stage_name FROM leads l LEFT JOIN lead_stages s ON l.stage_id = s.id WHERE l.id = $lead_id");
    $lead = mysqli_fetch_assoc($lead_res);
    if(!$lead) return;

$client_name = $lead['contact_name'] ?? $lead['name'];
    $client_phone = $lead['contact_no'] ?? $lead['mobile'];
    $stage_title = $lead['current_stage_name'] ?? 'Update';

$admin_phone = "9876543210"; 
    $assign_to_id = intval($lead['assign_to']);
    if($assign_to_id > 0) {
        $adm_res = mysqli_query($conn, "SELECT mobile FROM admin_tbl WHERE id = $assign_to_id");
        if($adm = mysqli_fetch_assoc($adm_res)) { if(!empty($adm['mobile'])) $admin_phone = $adm['mobile']; }
    }

if($trigger_event_type === 'CREATE') {
        $client_msg = "Hello {$client_name}, your property deal entry '{$lead['deal_name']}' is logged at step: {$stage_title}.";
        $admin_msg = "Notification: New deal registration added #LEAD-{$lead_id} ({$lead['deal_name']}) at stage: {$stage_title}.";
    } else {
        $client_msg = "Hello {$client_name}, your property deal file status changed to step: {$stage_title}.";
        $admin_msg = "Alert: File track modification updated #LEAD-{$lead_id} to state [{$stage_title}].";
    }

if(!empty($client_phone)) {
        executeJioDLTNotificationSMS($client_phone, $client_msg);
        $escaped_client_msg = mysqli_real_escape_string($conn, $client_msg);
        mysqli_query($conn, "INSERT INTO client_sms_logs (lead_id, stage_id, mobile, message, status) VALUES ($lead_id, $stage_id, '$client_phone', '$escaped_client_msg', 'Sent')");
    }

executeJioDLTNotificationSMS($admin_phone, $admin_msg);
    $escaped_admin_msg = mysqli_real_escape_string($conn, $admin_msg);
    mysqli_query($conn, "INSERT INTO admin_notifications (lead_id, title, message, is_read) VALUES ($lead_id, 'Stage Alert Mapping', '$escaped_admin_msg', 0)");
}

if (isset($_POST['async_stage_update'])) {
    header('Content-Type: application/json');
    $lead_id = intval($_POST['lead_id'] ?? 0);
    $stage_id = intval($_POST['stage_id'] ?? 0);
    $operator_id = $_SESSION['user_id'] ?? 1;

if ($lead_id > 0 && $stage_id > 0) {
        $prev_q = mysqli_query($conn, "SELECT stage_id FROM leads WHERE id = $lead_id");
        $prev = mysqli_fetch_assoc($prev_q);
        $old_stage_id = $prev ? ($prev['stage_id'] ?: "NULL") : "NULL";

if(mysqli_query($conn, "UPDATE leads SET stage_id = $stage_id, last_status_change = NOW(), last_updated_by = $operator_id, last_updated_at = NOW() WHERE id = $lead_id")) {
            mysqli_query($conn, "INSERT INTO lead_stage_history (lead_id, old_stage_id, new_stage_id, changed_by) VALUES ($lead_id, $old_stage_id, $stage_id, $operator_id)");
            broadcastDualCommunications($conn, $lead_id, $stage_id, 'STATUS_UPDATE');
            echo json_encode(['status' => 'success']); exit;
        }
    }
    echo json_encode(['status' => 'error', 'message' => 'Processing failed']); exit;
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $action = $_POST['action'] ?? '';
    $operator_id = $_SESSION['user_id'] ?? 1;

if ($action === 'create') {
        $contact_name = mysqli_real_escape_string($conn, $_POST['contact_name']);
        $contact_no = mysqli_real_escape_string($conn, $_POST['contact_no']);
        $deal_name = mysqli_real_escape_string($conn, $_POST['deal_name']);
        $party_type = mysqli_real_escape_string($conn, $_POST['party_type']);
        $authority = mysqli_real_escape_string($conn, $_POST['authority']);
        $location = mysqli_real_escape_string($conn, $_POST['location']);
        $reg_tdr_area = mysqli_real_escape_string($conn, $_POST['reg_tdr_area']);
        $rr_rate = mysqli_real_escape_string($conn, $_POST['rr_rate']);
        $slum_tdr_area = mysqli_real_escape_string($conn, $_POST['slum_tdr_area']);
        $rate_expectations = mysqli_real_escape_string($conn, $_POST['rate_expectations']);
        $ratio = mysqli_real_escape_string($conn, $_POST['ratio']);
        $expected_commission = mysqli_real_escape_string($conn, $_POST['expected_commission']);
        $sub_pipeline = mysqli_real_escape_string($conn, $_POST['sub_pipeline']);
        $reg_tdr_mrp = mysqli_real_escape_string($conn, $_POST['reg_tdr_mrp']);
        $slum_tdr_mrp = mysqli_real_escape_string($conn, $_POST['slum_tdr_mrp']);
        $description = mysqli_real_escape_string($conn, $_POST['description']);
        $deal_priority = mysqli_real_escape_string($conn, $_POST['deal_priority']);
        $closing_date = !empty($_POST['closing_date']) ? mysqli_real_escape_string($conn, $_POST['closing_date']) : NULL;
        $stage_id = intval($_POST['stage_id'] ?? 1);

$q = "INSERT INTO leads (lead_date, name, mobile, contact_name, contact_no, deal_name, party_type, authority, location, reg_tdr_area, rr_rate, slum_tdr_area, rate_expectations, ratio, expected_commission, sub_pipeline, reg_tdr_mrp, slum_tdr_mrp, description, deal_priority, closing_date, stage_id, created_at) 
              VALUES (CURDATE(), '$contact_name', '$contact_no', '$contact_name', '$contact_no', '$deal_name', '$party_type', '$authority', '$location', '$reg_tdr_area', '$rr_rate', '$slum_tdr_area', '$rate_expectations', '$ratio', '$expected_commission', '$sub_pipeline', '$reg_tdr_mrp', '$slum_tdr_mrp', '$description', '$deal_priority', ".($closing_date ? "'$closing_date'" : "NULL").", $stage_id, NOW())";
        
        if(mysqli_query($conn, $q)) {
            $new_id = mysqli_insert_id($conn);
            mysqli_query($conn, "INSERT INTO lead_stage_history (lead_id, old_stage_id, new_stage_id, changed_by) VALUES ($new_id, NULL, $stage_id, $operator_id)");
            
            // Fetch name matching the $stage_id for clean alerts layout
            $stage_name_q = mysqli_query($conn, "SELECT name FROM lead_stages WHERE id = $stage_id LIMIT 1");
            $stage_res = mysqli_fetch_assoc($stage_name_q);
            $new_stage_name = $stage_res ? $stage_res['name'] : 'Stage ' . $stage_id;

// Trigger administrative notification injection
            //Notification($conn, $new_id, $deal_name, 'New Entry', $new_stage_name);
            
            // broadcastDualCommunications($conn, $new_id, $stage_id, 'CREATE');
        }

}

if ($action === 'update') {
        $lead_id = intval($_POST['lead_id'] ?? 0);
        $contact_name = mysqli_real_escape_string($conn, $_POST['contact_name']);
        $contact_no = mysqli_real_escape_string($conn, $_POST['contact_no']);
        $deal_name = mysqli_real_escape_string($conn, $_POST['deal_name']);
        $party_type = mysqli_real_escape_string($conn, $_POST['party_type']);
        $authority = mysqli_real_escape_string($conn, $_POST['authority']);
        $location = mysqli_real_escape_string($conn, $_POST['location']);
        $reg_tdr_area = mysqli_real_escape_string($conn, $_POST['reg_tdr_area']);
        $rr_rate = mysqli_real_escape_string($conn, $_POST['rr_rate']);
        $slum_tdr_area = mysqli_real_escape_string($conn, $_POST['slum_tdr_area']);
        $sub_pipeline = mysqli_real_escape_string($conn, $_POST['sub_pipeline']);
        $deal_priority = mysqli_real_escape_string($conn, $_POST['deal_priority']);
        $closing_date = !empty($_POST['closing_date']) ? mysqli_real_escape_string($conn, $_POST['closing_date']) : NULL;
        $stage_id = intval($_POST['stage_id'] ?? 1);
        
        // Fetch old stage ID along with names before applying update modifications
        $prev_q = mysqli_query($conn, "SELECT l.stage_id, s.name as stage_name FROM leads l LEFT JOIN lead_stages s ON l.stage_id = s.id WHERE l.id = $lead_id");
        $prev = mysqli_fetch_assoc($prev_q);
        $old_stage_id = $prev ? ($prev['stage_id'] ?: "NULL") : "NULL";
        $old_stage_name = $prev ? ($prev['stage_name'] ?: 'Stage ' . $old_stage_id) : 'Unknown';

$prev_q = mysqli_query($conn, "SELECT stage_id FROM leads WHERE id = $lead_id");
        $prev = mysqli_fetch_assoc($prev_q);
        $old_stage_id = $prev ? ($prev['stage_id'] ?: "NULL") : "NULL";

$q = "UPDATE leads SET name='$contact_name', mobile='$contact_no', contact_name='$contact_name', contact_no='$contact_no', deal_name='$deal_name', party_type='$party_type', authority='$authority', location='$location', reg_tdr_area='$reg_tdr_area', rr_rate='$rr_rate', slum_tdr_area='$slum_tdr_area', sub_pipeline='$sub_pipeline', deal_priority='$deal_priority', closing_date=".($closing_date ? "'$closing_date'" : "NULL").", stage_id=$stage_id, last_status_change=NOW(), last_updated_by=$operator_id, last_updated_at=NOW() WHERE id=$lead_id";
        
        if(mysqli_query($conn, $q) && $old_stage_id != $stage_id) {
            mysqli_query($conn, "INSERT INTO lead_stage_history (lead_id, old_stage_id, new_stage_id, changed_by) VALUES ($lead_id, $old_stage_id, $stage_id, $operator_id)");
            
             // Fetch new stage name descriptive string
                $new_stage_name_q = mysqli_query($conn, "SELECT name FROM lead_stages WHERE id = $stage_id LIMIT 1");
                $new_stage_res = mysqli_fetch_assoc($new_stage_name_q);
                $new_stage_name = $new_stage_res ? $new_stage_res['name'] : 'Stage ' . $stage_id;
                
                  // Log running status tracking notification inside history database tables
             //   Notification($conn, $lead_id, $deal_name, $old_stage_name, $new_stage_name);
                
           // broadcastDualCommunications($conn, $lead_id, $stage_id, 'STATUS_UPDATE');
        }
    }
    
    function Notification($conn, $lead_id, $dealer_name, $old_stage, $new_stage) {
        $lead_id     = intval($lead_id);
        $dealer_name = mysqli_real_escape_string($conn, $dealer_name);
        $old_stage   = mysqli_real_escape_string($conn, $old_stage);
        $new_stage   = mysqli_real_escape_string($conn, $new_stage);
        
        $title   = "Lead Stage Updated";
        $message = "{$dealer_name} moved from {$old_stage} to {$new_stage}.";
        
        $sql = "INSERT INTO admin_notifications (lead_id, dealer_name, old_stage, new_stage, title, message, created_at, is_read) 
                VALUES ($lead_id, '$dealer_name', '$old_stage', '$new_stage', '$title', '$message', NOW(), 0)";
                
        return mysqli_query($conn, $sql);
    }

if ($action === 'delete') {
        $lead_id = intval($_POST['lead_id'] ?? 0);
        if($lead_id > 0) mysqli_query($conn, "DELETE FROM leads WHERE id=$lead_id");
    }

header("Location: lead_list.php");
    exit;
}

/* -------------------------------------------------------------
   Remaining normal Form POST / redirect code should sit safely below this line
---------------------------------------------------------------- */