A security analyst in an insurance company is assigned to test a new web application that will be used by clients to help them choose and apply for an insurance plan. The analyst discovers that the application is developed in ASP scripting language and it uses MSSQL as a database backend. The analyst locates the application's search form and introduces the following code in the search input field:

IMG SRC=vbscript:msgbox("Vulnerable");> originalAttribute="SRC" originalPath="vbscript:msgbox ("Vulnerable");>" When the analyst submits the form, the browser returns a pop-up window that says "Vulnerable". Which web applications vulnerability did the analyst discover?

Question

A security analyst in an insurance company is assigned to test a new web application that will be used by clients to help them choose and apply for an insurance plan. The analyst discovers that the application is developed in ASP scripting language and it uses MSSQL as a database backend. The analyst locates the application's search form and introduces the following code in the search input field:

IMG SRC=vbscript:msgbox("Vulnerable");> originalAttribute="SRC" originalPath="vbscript:msgbox ("Vulnerable");>" When the analyst submits the form, the browser returns a pop-up window that says "Vulnerable". Which web applications vulnerability did the analyst discover?

Accepted Answer

C. Cross-site scripting XSS occurs when an application reflects unvalidated user input back to the browser, allowing malicious scripts to execute in the client context. The injected IMG SRC with vbscript:msgbox() is a classic XSS payload that triggers client-side script execution without touching the server-side database. The browser rendering the popup confirms the application fails to sanitize or encode user-supplied input before outputting it to the page.

Answer

A. Cross-site request forgery Cross-site request forgery involves tricking an authenticated user's browser into sending forged requests, not injecting executable script payloads into input fields.

Answer

B. Command injection Command injection targets server-side OS shell interpreters by embedding shell metacharacters, not client-side browser script execution via HTML or VBScript tags.

Answer

D. SQL injection SQL injection manipulates database query logic through specially crafted input, not browser-rendered script tags like IMG SRC with vbscript.

A security analyst in an insurance company is assigned to test a new web application that will be used by clients to help them choose and apply for an insurance plan. The analyst discovers that the ap

Question

Options

How the community answered

Why each option

Topics

Community Discussion