A security analyst in an insurance company is assigned to test a new web application that will be used by clients to help them choose and apply for an insurance plan. The analyst discovers that the application is developed in ASP scripting language and it uses MSSQL as a database backend. The analyst locates the application's search form and introduces the following code in the search input field:

IMG SRC=vbscript:msgbox("Vulnerable");> originalAttribute="SRC" originalPath="vbscript:msgbox ("Vulnerable");>" When the analyst submits the form, the browser returns a pop-up window that says "Vulnerable". Which web applications vulnerability did the analyst discover?

Question

A security analyst in an insurance company is assigned to test a new web application that will be used by clients to help them choose and apply for an insurance plan. The analyst discovers that the application is developed in ASP scripting language and it uses MSSQL as a database backend. The analyst locates the application's search form and introduces the following code in the search input field:

IMG SRC=vbscript:msgbox("Vulnerable");> originalAttribute="SRC" originalPath="vbscript:msgbox ("Vulnerable");>" When the analyst submits the form, the browser returns a pop-up window that says "Vulnerable". Which web applications vulnerability did the analyst discover?

Accepted Answer

C. Cross-site scripting Cross-site scripting occurs when an attacker injects client-side script code into a web page that is then executed by the victim's browser. The payload 'IMG SRC=vbscript:msgbox()' is a classic XSS vector that abuses the VBScript protocol handler in older IE-based browsers. The resulting pop-up confirms that the browser interpreted and executed the injected script rather than treating it as plain text.

Answer

A. Cross-site request forgery Cross-site request forgery tricks an authenticated user's browser into sending an unintended request to a server - it does not involve injecting executable script into an input field.

Answer

B. Command injection Command injection targets server-side OS command execution by injecting shell metacharacters, not client-side script execution in the browser.

Answer

D. SQL injection SQL injection targets backend database queries by inserting SQL syntax into input fields, not JavaScript or VBScript that executes in the browser.

A security analyst in an insurance company is assigned to test a new web application that will be used by clients to help them choose and apply for an insurance plan. The analyst discovers that the…

Question

Options

How the community answered

Why each option

Topics

Community Discussion