SQL Injection - SQLite False Positive

[Kathy]

Hi - I am new to ZAP. I set my automatic session Context settings to run only for SQL Server but it is returning a false positive for SQLite as well. Can someone help me understand why this is happening? Thank you!

[thc...@gmail.com]

Hi,

Did you start the scan with the context? Which rule is raising the
alert? (Might be the generic one.)

Best regards.

[Kathy]

Yes I started scan with the context. I get the error with and without the context. Raising  SQL Injection - SQLite False Positive (see attached).

Why would I get this alert if we do not use SQLite?

Thank you!

[Simon Bennetts]

It says "SQL injection may be possible", rather than it _is_ possible.

If you're app does not use SQLite then configure ZAP to ignore it via the context.

Cheers,

Simon