What technique is used to perform a Connection Stream Parameter Pollution (CSPP) attack?

CSPP attacks target database connection strings, which use semicolons as delimiters between key-value parameter pairs. By injecting a semicolon followed by crafted parameters (such as 'Server=attacker' or 'Trusted_Connection=yes'), an attacker can override legitimate connection string values or inject malicious configuration. This technique exploits how connection string parsers process duplicate or appended parameters, potentially redirecting database connections or escalating privileges.

Injecting malicious JavaScript into input parameters describes a Cross-Site Scripting (XSS) attack, which targets client-side script execution in browsers, not database connection strings.

Setting a user's session identifier to a known explicit value describes a session fixation attack, which targets authentication session management rather than database connection parameters.

Adding multiple parameters with the same name in HTTP requests describes HTTP Parameter Pollution (HPP), which exploits how web servers and frameworks parse query strings, not database connection strings.