The scanner seems to be injecting a waitfor to see if it increases the time for search to return and is reporting that it is increasing the time.
The search methods in search.aspx are closed source in our edition, so I can't really verify if it is doing anything to protect against SQL injection.
Below is a snippet of the threat information from PCI Compliance scan. I am not including everything because I don't want to expose too much information.
THREAT REFERENCE
Summary:
Blind SQL injection vulnerability in ctl00$ctl00$NestedMaster$PageHeader$StoreHeader_H$SimpleSearch$SearchButton parameter to {page url}
Risk: High (3)
Port: 80/tcp
Protocol: tcp
Threat ID: web_prog_sql_blind
Details: When a web application uses user-supplied input parameters
within SQL queries without first checking them for unexpected
characters, it becomes possible for an attacker to
manipulate the query. This type of attack is known as a
SQL injection attack.
