Question

Difficulty: EasyApplication and Software Vulnerabilities

During a security audit of a web application, an analyst identifies software flaws caused by processing untrusted user data without proper sanitization or encoding. Which of the following application vulnerabilities result directly from improper input validation? (Select TWO.)

  1. SQL Injection (SQLi), where dynamic database statements execute arbitrary commands provided by untrusted input.Answer
  2. Cross-Site Scripting (XSS), where unencoded user input is rendered by the client web browser as executable script.Answer
  3. C
    Misconfigured network firewall access control lists that restrict routing between application subnets.
  4. D
    Conflating identity authentication verification mechanisms with role permission authorization assignments.

Answer

SQL Injection (SQLi) and Cross-Site Scripting (XSS) are both application vulnerabilities resulting directly from improper handling and validation of untrusted user input.
Both SQL Injection and Cross-Site Scripting directly stem from failure to validate, parameterize, or encode untrusted input before passing it to interpreters (such as a database engine or a browser rendering engine).

Step-by-Step Solution

1
Analyze the stem requirement
Identify vulnerabilities caused by improper handling or validation of untrusted input.
Input validation flaws occur when user-supplied input is processed by an interpreter without sanitization, parameterization, or encoding.
2
Evaluate each option
SQL Injection manipulates backend database interpreters due to unvalidated input, while Cross-Site Scripting manipulates frontend browser script interpreters due to unencoded output.
Both SQLi and XSS represent input validation and output encoding software vulnerabilities.

Key Concept

Application Input Validation Flaws
Estimated Time:1m 0s
Rate this question