Union based sql injection worked.

Original writeup (https://eine.tistory.com/entry/NeverLAN-CTF-2020-Web-SQL-Breaker-1-SQL-Breaker-2).