"Blind SQL Injection" alert from one scanner for Magento site...legit?

Question

I help manage a Magento site and one of the tools we use in our efforts to stay on top of site security is Decertify. I just ran a report & it came back with a warning about possible "blind SQL injection". We have all the patches installed (including SUPEE-5344), we haven't noticed anything out of the ordinary in the database or files, and we've run every malware scanner on the planet (all clean). Decertify tried the following code in the URL:

http://yourstorename.com/?dir=-0;_=new%20Date();do%7B__=new%20Date();%7Dwhile(-_%3C100);_();/';=new%20Date();do%7B=new%20Date();%7Dwhile(-%3C100);();var%20x='%22;=new%20Date();do%7B=new%20Date();%7Dwhile(__-%3C100);();var%20x=%22*/ HTTP/1.1

Note: there's an asterisk after the .com/ (it's deleting it)

I tried it myself & a 403 Forbidden comes up.

Decertify reasoning is: "The graph describes two sets of requests. The most dominant one describes our active probes, which intentionally will make the server delay for a short amount of time. The other set contain passive probes that are made to be executed by the back end server but without any delay. The differences between these two sets indicate that an injection is present."

My questions:

1. Does the fact that the 403 is coming mean that I shouldn't have to worry about this? That it's being blocked properly?
2. Isn't this something that's supposed to be blocked by plugs made by the security patches? (specifically SUPEE-5344)
3. Have you ever heard of a test like this done to determine whether an injection is present or not?

Any guidance or thoughts would be much appreciated!

UPDATE: I ran the scan again & it didn't show up this time. Still interested in what you all have to say.

Answer 1

Here's the detectify result (w/ appropriate info blacked out). Note that it's not showing up anymore. I'm just curious if I should concerned about this or not. Maybe it was just a fluke? Or it just miscalculated server response? let me know your thoughts. Thanks!