I'm pen testing an application. The URL is basically
app exists it gives correct output, but if it doesn't exist we get a internal server error 500.
Vega detects it as a SQL injection vulnerability, but when I test it with sqlmap it cannot find injection in this url. Vega shows the URL
app.php?app=appname'%20AND%201=2%20--%20, but it also gives the same internal error.
In this case is it really a SQL injection vulnerability? Can I force sqlmap to use this URL as a help?