Examkin

Question

Difficulty: MediumApplication and Software Vulnerabilities

A security analyst is conducting a vulnerability assessment on a company's web portal source code and server logs. The audit identifies that input from a search field is concatenated directly into a backend database statement without input sanitization. Additionally, users can view arbitrary account records by modifying the user ID parameter in the HTTP GET request line because server-side authorization validation is absent. Which of the following application vulnerabilities are present in this scenario? (Select TWO.)

  1. SQL injection (SQLi)Answer
  2. Insecure Direct Object Reference (IDOR)Answer
  3. C
    Cross-Site Scripting (XSS)
  4. D
    Improper perimeter firewall access control lists (ACLs)

Answer

The web application exhibits SQL injection due to unsanitized input concatenation into database queries, and Insecure Direct Object Reference (IDOR) due to missing server-side authorization checks on URL resource identifier parameters.
SQL injection occurs when unvalidated user input is directly concatenated into database query statements, allowing attackers to execute arbitrary SQL commands. Insecure Direct Object Reference occurs when an application exposes a reference to an internal implementation object, such as a user identifier parameter, without performing server-side authorization checks to verify user permissions.

Step-by-Step Solution

1
Examine the database input processing mechanism
Unsanitized user search input concatenated into backend query strings exposes the database to SQL injection (SQLi).
Database calls must use parameterized queries or input sanitization to prevent untrusted data from altering query execution structure.
2
Evaluate the parameter-based resource access model
Manipulating request URL parameters to fetch other users' profile data without authorization checks indicates Insecure Direct Object Reference (IDOR).
Applications must perform explicit server-side access control validation whenever internal object references are supplied by clients.

Key Concept

Application and Software Vulnerabilities
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic