Zploit 0-Day Shell

:: Editing File: quotation_save.php

<?php
ob_start();

include "db.php"; // Database connection file

if ($_SERVER['REQUEST_METHOD'] == 'POST') {

// 1. Sanitize & Collect Master Details
    $quotation_no     = mysqli_real_escape_string($conn, trim($_POST['quotation_no'] ?? ''));
    $quotation_date   = mysqli_real_escape_string($conn, trim($_POST['quotation_date'] ?? ''));
	
    /*$lead_id          = !empty($_POST['lead_id']) ? intval($_POST['lead_id']) : "NULL";
    $client_name      = mysqli_real_escape_string($conn, trim($_POST['client_name'] ?? ''));
    $developer_name   = mysqli_real_escape_string($conn, trim($_POST['developer_name'] ?? ''));
    $project_location = mysqli_real_escape_string($conn, trim($_POST['project_location'] ?? ''));*/
	
	$lead_id          = !empty($_POST['lead_id']) ? intval($_POST['lead_id']) : "NULL";
    $client_name      = !empty($_POST['client_name']) ? intval($_POST['client_name']) : "NULL";
    $client_no      = !empty($_POST['client_no']) ? intval($_POST['client_no']) : "NULL";
    $developer_name   = !empty($_POST['developer_name']) ? intval($_POST['developer_name']) : "NULL";
    $project_location = !empty($_POST['project_location']) ? intval($_POST['project_location']) : "NULL";
	
    $status           = mysqli_real_escape_string($conn, trim($_POST['status'] ?? 'Draft'));
    $remarks          = mysqli_real_escape_string($conn, trim($_POST['remarks'] ?? ''));
    $prepared_by      = isset($_SESSION['user_id']) ? intval($_SESSION['user_id']) : "NULL";

// Basic Validation
    if (empty($quotation_no) || empty($quotation_date)) {
        echo "<script>alert('Error: Required fields (Quotation No or Date) are missing.'); window.history.back();</script>";
        exit;
    }

// Begin Database Transaction for Data Consistency
    mysqli_begin_transaction($conn);

try {
        // 2. Insert Into quotation_master Table
        $master_query = "INSERT INTO quotation_master 
            (quotation_no, quotation_date, lead_id, client_name, client_no, developer_name, project_location, status, remarks, prepared_by) 
            VALUES 
            ('$quotation_no', '$quotation_date', $lead_id, '$client_name', '$client_no', '$developer_name', '$project_location', '$status', '$remarks', $prepared_by)";

if (!mysqli_query($conn, $master_query)) {
            throw new Exception("Master Save Failed: " . mysqli_error($conn));
        }

// Get the generated Master ID
        $quotation_id = mysqli_insert_id($conn);

// 3. Insert Into quotation_details Table
        if (isset($_POST['drc_type']) && is_array($_POST['drc_type'])) {
            
            $drc_types            = $_POST['drc_type'];
            $ready_reckoner_rates = $_POST['ready_reckoner_rate'] ?? [];
            $quantities           = $_POST['quantity'] ?? [];
            $mrps                 = $_POST['mrp'] ?? [];
            $premium_rates        = $_POST['premium_rate'] ?? [];
            $mrps_after_premium   = $_POST['mrp_after_premium'] ?? [];
            $agreement_values     = $_POST['agreement_value'] ?? [];
            $separate_cheques     = $_POST['separate_cheque'] ?? [];
            $total_amounts        = $_POST['total_amount_payable'] ?? [];
            $stamp_duties         = $_POST['stamp_duty'] ?? [];
            $reg_charges          = $_POST['registration_charge'] ?? [];
            $power_attorneys      = $_POST['power_of_attorney'] ?? [];
            $doc_charges          = $_POST['document_charge'] ?? [];
            $advocate_fees        = $_POST['advocate_fee'] ?? [];
            $brokerages           = $_POST['brokerage'] ?? [];
            $total_other_expenses = $_POST['total_other_expense'] ?? [];
            $grand_totals         = $_POST['grand_total'] ?? [];
            $total_tdr_expense    = floatval($_POST['total_tdr_expense'] ?? 0);

// Loop through each dynamic column (e.g., Regular, Slum, etc.)
            foreach ($drc_types as $index => $type) {
                
                $drc_type            = mysqli_real_escape_string($conn, trim($type));
                $ready_reckoner_rate = floatval($ready_reckoner_rates[$index] ?? 0);
                $quantity            = floatval($quantities[$index] ?? 0);
                $mrp                 = floatval($mrps[$index] ?? 0);
                $premium_rate        = floatval($premium_rates[$index] ?? 0);
                $mrp_after_premium   = floatval($mrps_after_premium[$index] ?? 0);
                $agreement_value     = floatval($agreement_values[$index] ?? 0);
                $separate_cheque     = floatval($separate_cheques[$index] ?? 0);
                $total_amount        = floatval($total_amounts[$index] ?? 0);
                $stamp_duty          = floatval($stamp_duties[$index] ?? 0);
                $registration_charge = floatval($reg_charges[$index] ?? 0);
                $power_of_attorney   = floatval($power_attorneys[$index] ?? 0);
                $document_charge     = floatval($doc_charges[$index] ?? 0);
                $advocate_fee        = floatval($advocate_fees[$index] ?? 0);
                $brokerage           = floatval($brokerages[$index] ?? 0);
                $total_other_exp     = floatval($total_other_expenses[$index] ?? 0);
                $grand_total         = floatval($grand_totals[$index] ?? 0);

// Insert dynamic column item into quotation_details
                $detail_query = "INSERT INTO quotation_details 
                    (quotation_id, drc_type, ready_reckoner_rate, quantity, mrp, premium_rate, mrp_after_premium, agreement_value, separate_cheque, total_amount_payable, stamp_duty, registration_charge, power_of_attorney, document_charge, advocate_fee, brokerage, total_other_expense, grand_total, total_tdr_expense) 
                    VALUES 
                    ('$quotation_id', '$drc_type', '$ready_reckoner_rate', '$quantity', '$mrp', '$premium_rate', '$mrp_after_premium', '$agreement_value', '$separate_cheque', '$total_amount', '$stamp_duty', '$registration_charge', '$power_of_attorney', '$document_charge', '$advocate_fee', '$brokerage', '$total_other_exp', '$grand_total', '$total_tdr_expense')";

if (!mysqli_query($conn, $detail_query)) {
                    throw new Exception("Details Save Failed: " . mysqli_error($conn));
                }
            }
        }

// Commit transaction if all queries succeed
        mysqli_commit($conn);

echo "<script>
            alert('Quotation created successfully!');
            window.location.href = 'quotation_list.php';
        </script>";
        exit;

} catch (Exception $e) {
        // Rollback any half-done insertions on failure
        mysqli_rollback($conn);
        echo "<script>
            alert('Error saving quotation: " . addslashes($e->getMessage()) . "');
            window.history.back();
        </script>";
        exit;
    }

} else {
    header("Location: quotation_list.php");
    exit;
}
?>