IBM Appscan has detected that some pages in our system are vulnerable to SQL Injection.
The report shows which URLs are vulnerable, so I checked the pages based on the URLs, but most of the pages reported used CAML query to retrieve/add new/update data from list, so no straight SQL query to Database.
I do some research about SQL Injection in CAML query, and found this Link
The question is, is CAML query vulnerable to SQL Injection? If no, is there any proof documentation or something? If yes, then how do we prevent it?