200-901 Question 128
Single answerA developer is building a web application that accepts user input through a form and stores the data in a database. In a security review, it was discovered that the application is vulnerable to an OWASP Top 10 threat where malicious users can inject unauthorized SQL commands through the form input. Which OWASP threat best describes this scenario?
- A
Cross-Site Scripting (XSS)
- B
SQL Injection
- C
Cross-Site Request Forgery (CSRF)
- D
Insecure Deserialization
Show answer and explanation
Correct answer: B
Explanation
SQL Injection is one of the OWASP Top 10 security risks. It occurs when user input is improperly sanitized, allowing attackers to inject malicious SQL queries that can manipulate the application's database. In this scenario, the application's vulnerability to malicious SQL commands aligns with the definition of SQL Injection.
- A. Incorrect.
Cross-Site Scripting (XSS) occurs when an attacker injects malicious scripts into a web page that is viewed by other users. This does not involve injecting SQL commands into a database.
- B. Correct.
SQL Injection is a type of attack where an attacker injects malicious SQL queries into an input field to manipulate the database. This directly matches the scenario described.
- C. Incorrect.
Cross-Site Request Forgery (CSRF) tricks authenticated users into performing actions they did not intend, such as transferring funds or changing data. This does not involve SQL commands or database manipulation.
- D. Incorrect.
Insecure Deserialization occurs when untrusted data is used to abuse the logic of an application or execute arbitrary code. This is unrelated to SQL injection or database vulnerabilities.