I have done a normal scan (not fuzzing) of a website using ZAP in attack mode, and it gives me several possible injections. My question is if there is any way to try to exploit these within ZAP, without using SQL map myself?
No. (at least not in the versions I have worked with)
ZAP is not an exploitation tool, it is a vulnerability detection tool. You can however fuzz with ZAP to determine if SQL injection is possible but as it already detected a possible SQL injection the next step is exploiting it in order to verify if it is a true / false positive.
If this is a legitimate security assessment, what's wrong with using SQLmap or trying to exploit it manually?
Using the Zap browser (MITM) you can highlight the POST or GET that you wish to try to exploit, then replay it with modified inputs. In the Quick Start tab, scroll down to the bottom of the window, launch your website in the browsers there. Navigate the site, then notice the returned information. Find the specific one you with to manually exploit right click on it, choose Open/Resend with Request Editor.. There you can modify the data prior to sending.. and get back any server side response.