> It's very clever - a variation on timing failed login/password attempts.

Can you explain? To me it just looks like a way to prove the exploit exists without revealing any actual injections.

It's a pretty common technique for exploiting Blind SQLi. You can use this as the one of the Branches in a SELECT IF to be able to determine the value of something in the DB.

https://www.owasp.org/index.php/Blind_SQL_Injection#Time-bas...