I am testing an API and one parameter is vulnerable to SQL injection. When I run OWASP ZAP's fuzzer on this parameter, the input "; or 1=1" results in a successful exploit of SQL injection. However, manually supplying this input results in an Oracle error code and the exploit is not successful.
Is it the case then that fuzzers can result in successful exploits for certain inputs that manual testing cannot? I am trying to understand more about fuzzers and it seems to me that fuzzers can generate certain conditions that manual testing can't generate. Is this correct? If so, why?