We are using netsparker cloud version On last week when netsparker scan it detect SQL Injection Vulnerabilities.
However I am surprised as the injection query throw error for casting and the scanner has extract SQL server version information.
microsoft sql server 2012 (sp3) (kb3072779) - 11.0.6020.0 (x64)
oct 20 2015 15:36:27
copyright (c) microsoft corporation
web edition (64-bit) on windows nt 6.3 <x64> (build 9600: ) (hypervisor)
String used for injection
'AND 1=cast(0x5f21403264696c656d6d61 as varchar(8000)) or '1'='
When form submitted in response server throw error for casting as below.
Conversion failed when converting the varchar value '_!@2dilemma' to data type int.
Then I tried to look on web and I found below links but the do not have information how they extract data.