The Payload worked in HTTP/1.0 and not in HTTP/1.1 .
TL;DR: it worked in HTTP/1.0, it failed with an invalid HTTP/1.1 request but succeeded with a valid HTTP/1.1 request.
Have a look at the request which was sent:
GET / HTTP/1.x
X-Forwarded-For: hacker' OR sleep(5) AND '1'='1 --+
While HTTP/1.0 and HTTP/1.1 look about the same there are some important differences. One is that HTTP/1.1 requires the client to send a
Host header in the request, i.e. something like
Host: www.example.com. While this header was possible and widely used with HTTP/1.0 too it was not mandatory in HTTP/1.0 but is mandatory in HTTP/1.1. This means that the request you send is actually invalid with HTTP/1.1 which explains the response you get back from the server:
For HTTP/1.1 : I Immediately get 400 Bad Request
This immediate response from the server means that the request was rejected and not forwarded to the vulnerable web application. The well-formed HTTP/1.0 request instead was not rejected and resulted in the successful exploit:
For HTTP/1.0 : I get 200 OK after 5 seconds
After the HTTP/1.1 request was fixed the exploit worked there too:
Once I added Host Header. SQLi worked with 1.1 as well.