nerdexam
CompTIA

CS0-003 · Question #634

A security analyst is testing a web application for vulnerabilities using Burp Suite. During the assessment, a capture of the following HTTP request and response is shown in the command- line…

The correct answer is B. CSRF. The request performs a sensitive account action (updating an email address) using only a session cookie and no CSRF token or similar validation. When state-changing requests lack anti- CSRF protections, an attacker can trick a victim into unknowingly submitting such a request…

Submitted by salim_om· Mar 6, 2026Vulnerability Management

Question

A security analyst is testing a web application for vulnerabilities using Burp Suite. During the assessment, a capture of the following HTTP request and response is shown in the command- line interface:

After inspecting the request, the security analyst notices that it does not include any additional protections or validation mechanisms. Which of the following vulnerabilities is most likely present in the web application?

Exhibit

CS0-003 question #634 exhibit

Options

  • AIDOR
  • BCSRF
  • CSQLi
  • DXSS

How the community answered

(18 responses)
  • A
    6% (1)
  • B
    72% (13)
  • C
    17% (3)
  • D
    6% (1)

Explanation

The request performs a sensitive account action (updating an email address) using only a session cookie and no CSRF token or similar validation. When state-changing requests lack anti- CSRF protections, an attacker can trick a victim into unknowingly submitting such a request, making CSRF the most likely vulnerability.

Topics

#web application security#CSRF#Burp Suite#vulnerability testing

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CS0-003 Practice