`, submitted through an unvalidated search input and subsequently executed within victim browser sessions. Which of the following application vulnerabilities is present?","text":"A security analyst reviews web application logs and observes client-side script payloads, such as ``, submitted through an unvalidated search input and subsequently executed within victim browser sessions. Which of the following application vulnerabilities is present?","inLanguage":"tr","acceptedAnswer":{"@type":"Answer","text":"Cross-Site Scripting (XSS)","answerExplanation":{"@type":"Comment","text":"Cross-Site Scripting (XSS) is present because client-side JavaScript payloads are injected through user input and executed within victim browsers. Cross-Site Scripting (XSS) occurs when an application includes unvalidated data in a web page delivered to a browser, enabling attackers to execute client-side scripts in victim user sessions."}},"eduQuestionType":"Multiple choice","isAccessibleForFree":true},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Examkin","item":"https://examkin.com/tr"},{"@type":"ListItem","position":2,"name":"CompTIA Security+","item":"https://examkin.com/tr/exams/comptia-security-plus"},{"@type":"ListItem","position":3,"name":"Threats, Vulnerabilities, and Mitigations","item":"https://examkin.com/tr/exams/comptia-security-plus/t/SECURITY_CORE__threats_vulnerabilities_and_mitigations"},{"@type":"ListItem","position":4,"name":"Application and Software Vulnerabilities","item":"https://examkin.com/tr/exams/comptia-security-plus/t/SECURITY_CORE__threats_vulnerabilities_and_mitigations__application_and_software_vulnerabilities"},{"@type":"ListItem","position":5,"name":"Soru","item":"https://examkin.com/tr/exams/comptia-security-plus/q/e3dc5880-d302-4705-a9b8-43d50f80397d"}]}]
Soru
Zorluk: KolayApplication and Software Vulnerabilities
A security analyst reviews web application logs and observes client-side script payloads, such as `<script>document.cookie</script>`, submitted through an unvalidated search input and subsequently executed within victim browser sessions. Which of the following application vulnerabilities is present?
Cross-Site Scripting (XSS)Cevap
B
SQL Injection (SQLi)
C
Broken Authorization
D
Network Layer Firewall Failure
Cevap
Cross-Site Scripting (XSS) is present because client-side JavaScript payloads are injected through user input and executed within victim browsers.
Cross-Site Scripting (XSS) occurs when an application includes unvalidated data in a web page delivered to a browser, enabling attackers to execute client-side scripts in victim user sessions.
Adım Adım Çözüm
1
Analyze the log payload and target execution context
The log entry contains HTML `<script>` tags executing JavaScript in the victim's browser context.
Distinguishing between server-side database commands and client-side browser scripts identifies the vulnerability class.
2
Match the behavior to the software vulnerability definition
Injecting malicious scripts into web application parameters that run in another user's browser corresponds directly to Cross-Site Scripting (XSS).
XSS specifically exploits improper input sanitization and output encoding on client-facing web application fields.