During a security audit of a web application, an analyst identifies software flaws caused by processing untrusted user data without proper sanitization or encoding. Which of the following application vulnerabilities result directly from improper input validation? (Select TWO.)
- SQL Injection (SQLi), where dynamic database statements execute arbitrary commands provided by untrusted input.Answer
- Cross-Site Scripting (XSS), where unencoded user input is rendered by the client web browser as executable script.Answer
- CMisconfigured network firewall access control lists that restrict routing between application subnets.
- DConflating identity authentication verification mechanisms with role permission authorization assignments.
Answer
SQL Injection (SQLi) and Cross-Site Scripting (XSS) are both application vulnerabilities resulting directly from improper handling and validation of untrusted user input.
Both SQL Injection and Cross-Site Scripting directly stem from failure to validate, parameterize, or encode untrusted input before passing it to interpreters (such as a database engine or a browser rendering engine).
Step-by-Step Solution
Key Concept
Application Input Validation Flaws
Estimated Time:1m 0s