Few days back there was an audit and the report was the application was vulnerable to sql injection attack,

we query the database by calling

List result = session.createQuery("from LoginInfo where loginName = :loginName and password is null")
.setString("loginName", info.getLoginName())
.list();

I ran some test and could not find anything, can anyone please help me in understanding why its broken and how can it be fixed.

Thank You