A security analyst in an insurance company is assigned to test a new web application that will be used by clients to help them choose and apply for an insurance plan. The analyst discovers that the ap

Cross-site request forgery (CSRF) tricks an authenticated user's browser into sending unintended requests to a trusted site - it does not involve injecting scripts into input fields.

Command injection targets server-side operating system commands via vulnerable application calls, not client-side browser script execution triggered by rendered HTML.

The analyst injected a VBScript-bearing IMG tag into the search input, and the application reflected it back to the browser without sanitization, causing the script to execute and display a pop-up. This is reflected XSS - unsanitized user input is echoed into the page response and interpreted as executable code by the browser. The ASP/MSSQL stack has no bearing on the client-side script injection mechanism itself.

SQL injection manipulates the backend database query through input fields - the payload here contains no SQL syntax and the vulnerability manifests in the browser, not the database.