Zploit 0-Day Shell

:: Editing File: addtocart.php

<?php 
include "admin/param.php";
include "admin/func.php";
include "live.php";
if (chf('sub_mit') == "Yes")
{
	if (ch_f_int('qty') > 0)
	{
		$Opt_val_1 = "";
		$Opt_val_2 = "";
		$Opt_1 = "";
		if (ch('opt1') != "")
		{
			$OPT = qry_run("Select * from tbl_prod_opt where sid = ".ch_f_int('opt1')."");
			if (num_rec($OPT) > 0)
			{
				$rsp = fetch_rec($OPT);
				$Opt_val_1 = $rsp['pname'];
			}
		}
		if (ch('opt2') != "")
		{
			$OPT = qry_run("Select * from tbl_prod_opt where sid = ".ch_f_int('opt2')."");
			if (num_rec($OPT) > 0)
			{
				$rsp = fetch_rec($OPT);
				$Opt_val_2 = $rsp['pname'];
			}
		}
		if ($Opt_val_1 != "")
		{
			if ($Opt_val_2 != "")
			{
				$Opt_1 = $Opt_val_1.",".$Opt_val_2;
			}else{
				$Opt_1 = $Opt_val_1;
			}
		}else{
			if ($Opt_val_2 != "")
			{
				$Opt_1 = $Opt_val_2;
			}else{
				$Opt_1 = "";
			}
		}
		
		
		$SRC = qry_run("Select * from tbl_cart where pid = ".$pid." AND sid = '".$sessionid."'");
		if (num_rec($SRC) > 0)
		{
			$UPD = qry_run("Update tbl_cart Set qty = ".ch_f_int('qty').",opt = '".$Opt_1."' where pid = ".$pid." AND sid = '".$sessionid."'");
			if (!$UPD)
			{
				echo mysql_error();
				die;
			}
		}else{
			$PROD = qry_run("Select * from tbl_prods where pid = ".$pid."");
			if (num_rec($PROD) > 0)
			{
				$prd = fetch_rec($PROD);
					
					$QRY = qry_run("Insert into tbl_cart (pid,sid,live,pname,opt,pdetail,sdetail,prate,pcode,qty,img1) VALUES (".$pid.",'".$sessionid."','".chf('live')."','".addslashes($prd['pname'])."','".addslashes($Opt_1)."','".addslashes($prd['pdetail'])."','".addslashes($prd['sdetail'])."',".$prd['prate'].",'".$prd['part']."','".ch_f_int('qty')."','".$prd['img1']."')");
					if (!$QRY)
					{
						echo mysql_error();
						die;
					}
			}
		}
			
	}else{
		header("Location: products.php?live=".chf('live'));
		die;
	}
}
header("Location: basket.php");
die;
?>