Zploit 0-Day Shell

:: Editing File: ticket_crud_processor.php

<?php
ini_set('display_errors', 1);
error_reporting(E_ALL);

include("session.php");

/* ---------- AJAX HANDLING BLOCK AT THE VERY TOP OF FILE ---------- */

if (isset($_POST['update_ticket_fields'])) 
{
    // Clear any previous spaces/errors accidentally printed by other includes
    if (ob_get_length()) ob_clean(); 
    
    header("Content-Type: application/json");

$ticket_id = intval($_POST['ticket_id']);

if (isset($_POST['admin_note'])) 
    {
        $note = mysqli_real_escape_string($conn, $_POST['admin_note']);
        $sql = "UPDATE tickets SET admin_note='$note' WHERE id='$ticket_id'";
    } 
    elseif (isset($_POST['message_revision'])) 
    {
        $msg_rev = mysqli_real_escape_string($conn, $_POST['message_revision']);
        $sql = "UPDATE tickets SET message='$msg_rev' WHERE id='$ticket_id'";
    } 
    else 
    {
        echo json_encode([
            "status" => "error",
            "message" => "No operational field supplied."
        ]);
        exit;
    }

if (mysqli_query($conn, $sql)) 
    {
        echo json_encode([
            "status" => "success",
            "message" => "Ticket Field Updated Successfully"
        ]);
    } 
    else 
    {
        echo json_encode([
            "status" => "error",
            "message" => mysqli_error($conn)
        ]);
    }

exit; // Crucial: Ensures absolutely nothing else on this page runs!
}

/* ---------- SYSTEM NOTIFICATION & COMMUNICATION PIPELINES ---------- */

function executeJioDLTNotificationSMS($recipient_phone, $message_text) {
    $apiKey = "YOUR_FAST2SMS_API_KEY"; 
    $recipient_phone = preg_replace('/[^0-9]/', '', $recipient_phone);
    if(strlen($recipient_phone) == 12 && substr($recipient_phone, 0, 2) == "91") {
        $recipient_phone = substr($recipient_phone, 2);
    }
    if (strlen($recipient_phone) !== 10) return false;

$fields = array(
        "sender_id" => "YOUR_JIO_APPROVED_HEADER", 
        "message" => $message_text,
        "route" => "dlt", 
        "numbers" => $recipient_phone
    );

$curl = curl_init();
    curl_setopt_array($curl, array(
        CURLOPT_URL => "https://www.fast2sms.com/dev/bulkV2",
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_CUSTOMREQUEST => "POST",
        CURLOPT_POSTFIELDS => json_encode($fields),
        CURLOPT_HTTPHEADER => array("authorization: " . $apiKey, "accept: */*", "content-type: application/json"),
    ));
    $response = curl_exec($curl);
    $err = curl_error($curl);
    curl_close($curl);
    return !$err;
}

function broadcastTicketCommunications($conn, $ticket_id, $status, $trigger_event_type) {
    $operator_id = $_SESSION['user_id'] ?? 1;
    
    // Join admin/user table context to grab phone profiles if needed
    $tck_res = mysqli_query($conn, "SELECT t.*, u.name as user_fullname, u.mobile as user_phone FROM tickets t LEFT JOIN admin_tbl u ON t.user_id = u.id WHERE t.id = $ticket_id");
    $ticket = mysqli_fetch_assoc($tck_res);
    if(!$ticket) return;

$user_name = $ticket['user_fullname'] ?? 'User';
    $client_phone = $ticket['user_phone'] ?? '';
    $status_title = strtoupper($status);

$admin_phone = "9876543210"; // Base alert fallback channel

if($trigger_event_type === 'CREATE') {
        $client_msg = "Hello {$user_name}, your Support Ticket #TCK-{$ticket_id} ('{$ticket['subject']}') has been logged successfully.";
        $admin_msg = "Helpdesk Alert: New ticket filed #TCK-{$ticket_id} by {$user_name} Subj: {$ticket['subject']}.";
    } else {
        $client_msg = "Hello {$user_name}, your Ticket #TCK-{$ticket_id} status modified to state: {$status_title}.";
        $admin_msg = "Helpdesk Update: Ticket #TCK-{$ticket_id} altered to operational track [{$status_title}].";
    }

if(!empty($client_phone)) {
        executeJioDLTNotificationSMS($client_phone, $client_msg);
        $escaped_client_msg = mysqli_real_escape_string($conn, $client_msg);
        mysqli_query($conn, "INSERT INTO client_sms_logs (lead_id, stage_id, mobile, message, status) VALUES ($ticket_id, 0, '$client_phone', '$escaped_client_msg', 'Sent')");
    }

executeJioDLTNotificationSMS($admin_phone, $admin_msg);
    $escaped_admin_msg = mysqli_real_escape_string($conn, $admin_msg);
    mysqli_query($conn, "INSERT INTO admin_notifications (lead_id, title, message, is_read) VALUES ($ticket_id, 'Ticket Status Alert', '$escaped_admin_msg', 0)");
}

/* ---------- INLINE INTERACTIVE UPDATE LISTENER (E.G. DROPDOWN STATUS UPDATE) ---------- */

if (isset($_POST['async_status_update'])) {
    header('Content-Type: application/json');
    $ticket_id = intval($_POST['ticket_id'] ?? 0);
    $status = mysqli_real_escape_string($conn, $_POST['status'] ?? '');
    $operator_id = $_SESSION['user_id'] ?? 1;

if ($ticket_id > 0 && in_array($status, ['open', 'in_progress', 'closed'])) {
        $prev_q = mysqli_query($conn, "SELECT status FROM tickets WHERE id = $ticket_id");
        $prev = mysqli_fetch_assoc($prev_q);
        $old_status = $prev ? $prev['status'] : "open";

if(mysqli_query($conn, "UPDATE tickets SET status = '$status', updated_at = NOW() WHERE id = $ticket_id")) {
            mysqli_query($conn, "INSERT INTO ticket_status_history (ticket_id, old_status, new_status, changed_by) VALUES ($ticket_id, '$old_status', '$status', $operator_id)");
            broadcastTicketCommunications($conn, $ticket_id, $status, 'STATUS_UPDATE');
            echo json_encode(['status' => 'success']); exit;
        }
    }
    echo json_encode(['status' => 'error', 'message' => 'Processing status parameters failed']); exit;
}

/* ---------- STANDARD SYSTEM ROUTING HTTP METHOD WORKSPACE ---------- */

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $action = $_POST['action'] ?? '';
    $operator_id = $_SESSION['user_id'] ?? 1;

// 1. ADD NEW TICKET PROFILE
    if ($action === 'create') {
        $subject = mysqli_real_escape_string($conn, $_POST['subject']);
        $message = mysqli_real_escape_string($conn, $_POST['message']);
        $attachment_name = NULL;

// Process File Attachments if present
        if (isset($_FILES['attachment']) && $_FILES['attachment']['error'] === 0) {
            $target_dir = "uploads/tickets/";
            if (!file_exists($target_dir)) {
                mkdir($target_dir, 0777, true);
            }
            $file_ext = pathinfo($_FILES["attachment"]["name"], PATHINFO_EXTENSION);
            $attachment_name = "tck_" . time() . "_" . rand(1000, 9999) . "." . $file_ext;
            
            if (!move_uploaded_file($_FILES["attachment"]["tmp_name"], $target_dir . $attachment_name)) {
                $attachment_name = NULL;
            }
        }

$q = "INSERT INTO tickets (user_id, subject, message, attachment, status, created_at, updated_at) 
              VALUES ($operator_id, '$subject', '$message', " . ($attachment_name ? "'$attachment_name'" : "NULL") . ", 'open', NOW(), NOW())";
        
        if(mysqli_query($conn, $q)) {
            $new_id = mysqli_insert_id($conn);
            mysqli_query($conn, "INSERT INTO ticket_status_history (ticket_id, old_status, new_status, changed_by) VALUES ($new_id, NULL, 'open', $operator_id)");
            broadcastTicketCommunications($conn, $new_id, 'open', 'CREATE');
        }
    }

// 2. COMPLETE ROW DATA UPDATE PROFILE
    if ($action === 'update') {
        $ticket_id = intval($_POST['ticket_id'] ?? 0);
        $subject = mysqli_real_escape_string($conn, $_POST['subject']);
        $message = mysqli_real_escape_string($conn, $_POST['message']);
        $status = mysqli_real_escape_string($conn, $_POST['status']);

$prev_q = mysqli_query($conn, "SELECT status, attachment FROM tickets WHERE id = $ticket_id");
        $prev = mysqli_fetch_assoc($prev_q);
        $old_status = $prev ? $prev['status'] : "open";
        $current_attachment = $prev ? $prev['attachment'] : NULL;

// Handle updated file attachments replacing old ones
        if (isset($_FILES['attachment']) && $_FILES['attachment']['error'] === 0) {
            $target_dir = "uploads/tickets/";
            if (!file_exists($target_dir)) mkdir($target_dir, 0777, true);
            
            // Delete old file if exists
            if (!empty($current_attachment) && file_exists($target_dir . $current_attachment)) {
                unlink($target_dir . $current_attachment);
            }

$file_ext = pathinfo($_FILES["attachment"]["name"], PATHINFO_EXTENSION);
            $current_attachment = "tck_" . time() . "_" . rand(1000, 9999) . "." . $file_ext;
            move_uploaded_file($_FILES["attachment"]["tmp_name"], $target_dir . $current_attachment);
        }

$q = "UPDATE tickets SET subject='$subject', message='$message', attachment=" . ($current_attachment ? "'$current_attachment'" : "NULL") . ", status='$status', updated_at=NOW() WHERE id=$ticket_id";
        
        if(mysqli_query($conn, $q)) {
            if($old_status !== $status) {
                mysqli_query($conn, "INSERT INTO ticket_status_history (ticket_id, old_status, new_status, changed_by) VALUES ($ticket_id, '$old_status', '$status', $operator_id)");
                broadcastTicketCommunications($conn, $ticket_id, $status, 'STATUS_UPDATE');
            }
        }
    }

// 3. REMOVE TICKET DATA PROFILE ENTRY
    if ($action === 'delete') {
        $ticket_id = intval($_POST['ticket_id'] ?? 0);
        if($ticket_id > 0) {
            // Unlink documents from memory disk space
            $file_q = mysqli_query($conn, "SELECT attachment FROM tickets WHERE id = $ticket_id");
            if($f_row = mysqli_fetch_assoc($file_q)) {
                if(!empty($f_row['attachment']) && file_exists("uploads/tickets/" . $f_row['attachment'])) {
                    unlink("uploads/tickets/" . $f_row['attachment']);
                }
            }
            mysqli_query($conn, "DELETE FROM tickets WHERE id=$ticket_id");
        }
    }

header("Location: ticket_list.php");
    exit;
}
?>