Zploit 0-Day Shell

:: Editing File: submit_feed.php

<?php 
include "admin/param.php";
include "admin/func.php";
if (chf('sub_mit') == "Yes")
{
	if (chf('secure') == ch_session('security_code'))
	{
		if (chf('email') != "" && chf('fname') != "" && chf('message') != "")
		{
			$INC = qry_run("Insert into tbl_feedback (pname,company,address,phone,email,message,pdate) Values ('".chf('fname')."','".chf('company')."','".chf('address')."','".chf('phone')."','".chf('email')."','".chf('message')."','".date('d-m-Y')."')");
			$txtmail = "Feedback ----------------------------------------------------- ";
			$txtmail = $txtmail . "Name: ".chf('fname')." ";
			$txtmail = $txtmail . "Company: ".chf('company')." ";
			$txtmail = $txtmail . "E-mail: ".chf('email')." ";
			$txtmail = $txtmail . "Message: ".chf('message')." ";
			$_SESSION["security_code"] = "";
			if ($SEND_MAIL == "Yes")
			{
				$subject = "Catalogue Request ($web_name)";
				$headers = 'MIME-Version: 1.0' . "\r\n";
				$headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";
				$headers .= 'From: <'.chf('email').'>' . "\r\n";
				mail($email_to, $subject, $txtmail, $headers);
			}
			header("Location: content.php?p=4&sub=Y#feedback");
			die;
		}
	}	
}
header("Location: content.php?p=4#feedback");
die;
?>