Examkin

Question

Difficulty: Very hardApplication and Software Vulnerabilities

A security analyst inspecting web application access logs discovers the following HTTP POST request payload targeting an enterprise search endpoint:

`POST /api/v1/products/search HTTP/1.1`
`Host: portal.example.com`
`Content-Type: application/x-www-form-urlencoded`
`Payload: item_query=gadget' UNION SELECT credit_card_num, CVV FROM customer_payment_data WHERE '1'='1`

Which of the following vulnerabilities is being exploited in this scenario, and what is the primary application-level mitigation control required to prevent it?

  1. SQL injection; mitigated primarily by implementing parameterized database queries and prepared statements.Answer
  2. B
    Cross-site scripting (XSS); mitigated primarily by implementing context-aware output encoding and parameterized queries.
  3. C
    SQL injection; mitigated primarily by configuring network layer-3 stateful firewall rules to block unauthorized database ports.
  4. D
    Insecure Direct Object Reference (IDOR); mitigated primarily by enforcing multi-factor authentication on database endpoints.

Answer

SQL injection; mitigated primarily by implementing parameterized database queries and prepared statements.
The HTTP payload contains classic SQL injection syntax, specifically using single quotes to break out of data context and `UNION SELECT` to retrieve data from sensitive database tables (`customer_payment_data`). The definitive mitigation for SQL injection is adopting parameterized queries (prepared statements), which separate user data from SQL command logic at the application layer.

Step-by-Step Solution

1
Analyze the log payload syntax
Identified database manipulation keywords (`UNION SELECT`), string terminator (`'`), and boolean evaluation (`'1'='1`).
Determines the specific class of application vulnerability (SQL Injection).
2
Differentiate SQL injection from client-side or authorization flaws
Confirmed payload targets backend relational database tables (`customer_payment_data`), ruling out XSS or IDOR.
Prevents misdiagnosis of vulnerability types.
3
Evaluate appropriate remediation control layer
Selected parameterized queries/prepared statements as the effective software control rather than network-level firewalls.
Ensures remediation acts on application code where input interpretation occurs.

Key Concept

Application SQL Injection Identification and Parameterized Query Mitigation
Estimated Time:2m 0s
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic