CAS-002 · Question #566
What of the following vulnerabilities is present in the below source code file named AuthenticatedArea.php'? <html><head><title>AuthenticatedArea</title></head> <? include ("/inc/common.php")…
The correct answer is D. Cross-site scripting. The PHP code directly reflects unsanitized user input from $_REQUEST into the HTML output, creating a reflected cross-site scripting vulnerability.
Question
What of the following vulnerabilities is present in the below source code file named AuthenticatedArea.php'? <html><head><title>AuthenticatedArea</title></head> <? include ("/inc/common.php"); $username = $_REQUEST[username']; if ($username != "") { echo "Your username is: " . $_REQUEST[`username']; }else { header)("location: /login.php" } ?> </html>
Options
- AHeader manipulation
- BAccount disclosure
- CUnvalidated file inclusion
- DCross-site scripting
How the community answered
(51 responses)- A2% (1)
- B8% (4)
- C16% (8)
- D75% (38)
Why each option
The PHP code directly reflects unsanitized user input from $_REQUEST into the HTML output, creating a reflected cross-site scripting vulnerability.
Header manipulation requires attacker-controlled input to be injected into HTTP response headers via functions like header(), but the header() call here uses a hardcoded redirect string with no user input.
Account disclosure involves exposing credentials or account details from a data store; this code only echoes back the username the user themselves submitted, not sensitive stored account data.
Unvalidated file inclusion requires user input to influence the file path in an include/require statement; here the include path '/inc/common.php' is hardcoded and not derived from any request parameter.
The line 'echo "Your username is: " . $_REQUEST['username']' outputs raw user-supplied input directly into the HTML response without any encoding or sanitization. An attacker can inject malicious JavaScript (e.g., <script>alert(1)</script>) as the username parameter, which the browser will execute in the victim's session context. This is a textbook reflected XSS vulnerability.
Concept tested: Reflected cross-site scripting via unsanitized user input
Source: https://owasp.org/www-community/attacks/xss/
Topics
Community Discussion
No community discussion yet for this question.