Sqlmap doesn't find basic sql injection in login form

[ostrolucky]

Describe the bug
Website login form has a basic sql injection in form of just using ' or '1'='1 as a password, but sqlmap doesn't find it.

To Reproduce

1. Either make https://github.com/crashtest-security/fixme running locally, or use https://hack-me-if-you-can.herokuapp.com/?site=login.php
2. Run either sqlmap -u http://localhost:8080/\?site\=login.php --method=post --data="loggedin=on&username=admin&password=" --dbms=mysql -p password --not-string='Login unsuccessful!' ,
   or
   sqlmap -u "https://hack-me-if-you-can.herokuapp.com/?site=login.php" --method=post --data="loggedin=on&username=admin&password=" --dbms=mysql -p password --not-string='Login unsuccessful!' respectively

Expected behavior
NOT the current output:

[13:19:48] [WARNING] POST parameter 'password' does not seem to be injectable

I expect sqlmap would be able to log in and that way confirm that there actually is an sql injection present.

Running environment:

• sqlmap version 1.4.7#stable
• Installation method brew
• Operating system: MacOS Catalina
• Python version whatever is used in macos catalina, there are multiple python versions installed

Target details:

• MySQL

[stamparm]

p.s. --drop-set-cookie --risk=3