I just conducted an automated web scan with Burp Suite Pro. The scanner result indicated that our website had a high severity of code injection. It gave the following proof:
However, I don't understand why it interpreted like that:
"The application appears to evaluate user input as code. It was instructed to sleep for 0 seconds, and a response time of 1.1369998455 seconds was observed. It was then instructed to sleep for 10 seconds, which resulted in a response time of 15.8949999809 seconds"
Where to find the response which showed that the web app followed the instruction to sleep for xxx seconds? And why did it assess that the application appears to evaluate user input as code given that proof?
(I'm not specialized in web security pentest, but was assigned to do this task due to staff skeleton).