Examkin

Question

Difficulty: MediumApplication and Software Vulnerabilities

During a security review of a cloud-hosted feedback portal, an analyst discovers that user comments submitted to the support forum are stored in the application database without sanitization. When an administrator views the support dashboard, script tags embedded inside user comments execute within the administrator's browser session, attempting to transmit session tokens to an external host.

Which of the following correctly identifies the vulnerability type demonstrated in this incident and the most effective code-level remediation?

  1. Cross-Site Scripting (XSS); implement context-aware output encoding and input validation.Answer
  2. B
    SQL Injection (SQLi); implement parameterized database queries using prepared statements.
  3. C
    Buffer Overflow; configure stateful network firewall rules to drop oversized HTTP payload packets.
  4. D
    Broken Authentication; enforce multi-factor authentication (MFA) across all web portal endpoints.

Answer

Cross-Site Scripting (XSS); implement context-aware output encoding and input validation.
The correct option correctly identifies the flaw as Stored Cross-Site Scripting (XSS) and selects context-aware output encoding as the effective remediation. When untrusted input stored in a backend system is sent to a client browser without proper HTML/JS entity encoding, the browser interprets the input as executable code.

Step-by-Step Solution

1
Analyze the attack mechanism described in the scenario.
The injected payload consists of script tags stored in a database and executed in an administrator's browser upon rendering.
Execution of script code in the browser context of a viewing user indicates client-side code injection.
2
Identify the specific vulnerability class.
Stored (Persistent) Cross-Site Scripting (XSS).
Because the payload is persisted in the database before being rendered to other users, it fits the definition of Stored XSS.
3
Determine the proper code-level mitigation strategy.
Apply context-aware output encoding and validate input.
Encoding ensures that special characters like script tags are treated as text data rather than executable code by the browser parser.

Key Concept

Stored Cross-Site Scripting (XSS) Remediation
Estimated Time:1m 30s
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic