[pivoted]

Is the vulnerability in question a 'Blind SQL Injection' which is within the GET param 'dispform.aspx' ?
if so, it's a false positive. Adding any non-integer value to the GET param will make it look like a blind SQLI.

[pivoted]

No it just states "Vulnerabilities in sharepoint"

and it doesn't give you any specific info?