i did solve it it takes me 4 h
my hint:
1.read the source code
2.use that tool to steal some data(dont tink abute that hash nothing there well help you, you just want find that vulnerability)
3.brute force directory “dirb” or gobuster
4.what vulnerability you found in step 2 use that but you want more advance coomand