A security engineer is reviewing correlated telemetry in a SIEM console containing the following web application firewall (WAF) and database audit events:
text
2026-07-27T14:15:02Z waf01 http_request client_ip=198.51.100.44 uri="/api/v1/catalog" status=200 payload="' UNION SELECT username, password_hash FROM accounts--"
2026-07-27T14:15:02Z db01 query_exec db_user="app_service" query="SELECT * FROM products WHERE category = '' UNION SELECT username, password_hash FROM accounts--'" rows_returned=1420
Which of the following attack vectors was successfully executed against the application based on these log entries?
- ACross-Site Scripting (XSS) executing malicious client-side scripts inside the web browser.
- SQL injection bypassing query logic to exfiltrate unauthorized database records.Cevap
- CBroken authentication caused by failure to enforce access authorization controls on the API gateway.
- DA SIEM correlation engine parsing error misclassifying standard application traffic as a database anomaly.
Cevap
SQL injection bypassing query logic to exfiltrate unauthorized database records.
The WAF log captures a classic SQL injection vector (`UNION SELECT`), and the correlated database audit log shows that the query executed successfully (`rows_returned=1420`). This proves an SQL injection attack successfully extracted data from the database.
Adım Adım Çözüm
Anahtar Kavram
Correlating WAF payloads with database execution logs to detect SQL Injection