Zploit 0-Day Shell

:: Editing File: forgot_password.php

<?php
include "param.php";
include "func.php";
$message="";
$valid='true';
if($_SERVER["REQUEST_METHOD"] == "POST"){
    $email_reg=RealEscapeString($_POST['email']);//mysqli_real_escape_string($dbconfig,$_POST['email']);
    //$details=mysqli_query($dbconfig,"SELECT fullname,email FROM user WHERE email='$email_reg'");
    $QRY = qry_run("Select * from tbl_admin where email = '".$email_reg."'");
		if (num_rec($QRY) > 0)
		{
     //if the given email is in database, ie. registered
        $message_success=" Please check your email inbox or spam folder and follow the steps";
        //generating the random key
        $key=md5(time()+123456789% rand(4000, 55000000));
        //insert this temporary key into database
        $INC = qry_run("Insert into forget_password (email,temp_key) Values ('".$email_reg."','".$key."')");
        //$sql_insert=mysqli_query($dbconfig,"INSERT INTO forget_password(email,temp_key) VALUES('$email_reg','$key')");
        //sending email about update
        $to      = $email_reg;
        $subject = 'Password Change Request';
        $msg = "Please copy the link and paste in your browser address bar". "\r\n"."http://amtechint.com/admin/forgot_password_reset.php?key=".$key."&email=".$email_reg;
        $headers = 'From: reset@amtechint.com' . "\r\n" .
    'Reply-To: reset@amtechint.com' . "\r\n" .
    'X-Mailer: PHP/' . phpversion();

//mail($to, $subject, $message, $headers);
        mail($to, $subject, $msg, $headers);
    }
    else{
        $message="Sorry! no account associated with this email";
    }
}
?>
<!DOCTYPE html>
<html>
  <head>
    <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css" integrity="sha384-1q8mTJOASx8j1Au+a5WDVnPi2lkFfwwEAa8hDDdjZlpLegxhjVME1fgjWPGmkzs7" crossorigin="anonymous">
    <title>Forgot Password</title>
  </head>
  <body>
    <div class="container">
      <div class="row"><br><br><br>
        <div class="col-md-4"></div>
        <div class="col-md-4" style="background-color: #D2D1D1; border-radius:15px;">
          <br><br>
          <form role="form" method="POST">
            <div class="form-group">
              <label>Please enter your email to recover your password</label><br><br>
              <input  class="form-control" id="email" name="email" value="<?php echo isset($_POST['email']) ? $_POST['email'] : ''; ?>" placeholder="Email" >
            </div>
            
            <?php if (isset($error)) {
                      echo"<div class='alert alert-danger' role='alert'>
                      <span class='glyphicon glyphicon-exclamation-sign' aria-hidden='true'></span>
                      <span class='sr-only'>Error:</span>".$error."</div>";
                 } ?>
            <?php if ($message<>"") {
                      echo"<div class='alert alert-danger' role='alert'>
                      <span class='glyphicon glyphicon-exclamation-sign' aria-hidden='true'></span>
                      <span class='sr-only'>Error:</span>".$message."</div>";
                } ?>
            <?php if (isset($message_success)) {
                      echo"<div class='alert alert-success' role='alert'>
                      <span class='glyphicon glyphicon-ok' aria-hidden='true'></span>
                      <span class='sr-only'>Error:</span>".$message_success."</div>";
                  } ?>
              <button type="submit" class="btn btn-primary pull-right" name="submit" style="display: block; width: 100%;">Send Email</button>
              <br><br>
              <center><a href="index.php">Back to Login</a></center>
              <br>
          </form>
        </div>
        <div class="col-md-4"><br><br>
          
        </div>
      </div>
    </div>
  </body>
</html>