Specifically, this payload is designed to being returned by a legitimate database query. How This Payload Works

When an application is vulnerable to SQL injection, an attacker can append their own SQL commands to the original query.

The SQL snippet you've provided, ') UNION ALL SELECT NULL,NULL,NULL# , is a classic payload used to perform a attack.