Examkin

Question

Difficulty: EasyApplication and Software Vulnerabilities

A security specialist is reviewing code and application layer security controls for a public web portal. Which of the following vulnerabilities occur directly due to insufficient input validation and sanitization of user-supplied data? (Select TWO).

  1. SQL InjectionAnswer
  2. Cross-Site ScriptingAnswer
  3. C
    Hardware Hypervisor Escape
  4. D
    Insecure Password Complexity Requirements

Answer

The correct options are SQL Injection and Cross-Site Scripting.
SQL Injection and Cross-Site Scripting (XSS) are classic application vulnerabilities caused when input parameters are accepted and processed without adequate sanitization, escaping, or parameterized filtering.

Step-by-Step Solution

1
Analyze input-dependent software vulnerabilities
SQL Injection and Cross-Site Scripting both stem from failure to validate, escape, or parameterize user-supplied inputs.
Web application vulnerabilities at the code level frequently involve untrusted data being passed straight to database engines or web browsers.
2
Differentiate software flaws from policy and hardware virtualization issues
Hypervisor escapes deal with virtualization boundaries, while password complexity rules relate to authentication policies.
Input validation mitigates flaws where untrusted input changes command execution context, which applies specifically to SQLi and XSS.

Key Concept

Application Input Validation Flaws
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic