Skip to content

CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Softwares and Software Security

A web application accepts a user's login name and places it directly into a database query string without validation. An attacker types a fragment of query code into the login field and gains access to records of other users. Which vulnerability has the attacker exploited?

The attacker has exploited SQL injection. The application inserted unvalidated user input straight into a database query, so the attacker's typed code changed the query's logic and exposed other users' records. Input validation and parameterised queries are the standard defences against this weakness.

  1. ACross-site request forgery
  2. BSQL injectionCorrect
  3. CBuffer underflow in the browser
  4. DSession fixation through cookie expiry

Explanation

Unvalidated user input concatenated into a database query lets an attacker alter the query logic, which is SQL injection. Cross-site request forgery tricks an authenticated user's browser into sending unwanted requests and does not involve inserting query code through an input field.

Did you get it right without looking?

One question tells you little. A timed set on Softwares and Software Security shows your real accuracy, how long you take and where you lose marks.

Practise Softwares and Software SecurityFree diagnostic mock

More Softwares and Software Security questions