When I scanned my site for Vulnerabilities I found this error.
Various SQL errors were disclosed within the application source code or other files.
I have checked for sql injection and confirmed that it's not injectable.So how severe is this vulnerability? How an attacker could exploit it?
Not all SQL errors can be exploited, however you need to investigate why the SQL error was generated. Often it's a sign of bad input validation, even when not exploitable (by you) it should be fixed. Furthermore, in production environments, error messages should be generic and not disclose any details about the error or your system's configuration.
The main risk of SQL errors being displayed is that if the input is vulnerable to SQL injection, it makes life far FAR easier for an attacker. They can input bad queries and the error message will tell them the source of the problem and thus give them information about the database. If the query that is erroring can not be altered by any user input, or the input is truly completely validated, then it shouldn't be exploitable, but it's still best practice to avoid showing errors directly so that any future exploit can't utilize it to get information about the database.
Which vulnerability scanner did you use, as I know a lot of them show up as false-positives (not exploitable but still need to be addressed as a lot of the time it can give out private information such as schema information, user information, etc).
Also if you want to and is applicable, it may be an idea to run SQLMap or SQLNinja on it and see what it comes up.
Alternatively, you could always write your own payload.
