My application is using mysql database but why it detected sql injection - SQLite?

[ZHEN XIAN LIM]

Why sqlite injection can happened in my application when the database I used is mysql only?

[Simon Bennetts]

ZAP does not know what database you are using. By default it will attempt to attack all dbs.

If it finds a vulnerability in a db other than the one you are using then either:

• The attack just happens to work for both dbs
• Its a false positive

We have a FAQ for handling false positives: https://www.zaproxy.org/faq/how-do-i-handle-a-false-positive/

You can also tell ZAP which technology your app is using via a Context: https://www.zaproxy.org/docs/desktop/ui/dialogs/session/contexts/#technology

This is strongy recommended - it will both speed up your scan time and potentially reduce false positives.

Cheers,

Simon

[ZHEN XIAN LIM]

Sorry to disturb you again on this question. May I know how do I know if the attack just happens to work for both dbs? Can you teach me how to I deal with this question? Feel free to ask me if you need any extra information?