nerdexam
GIAC

GCIH · Question #316

John works as a professional Ethical Hacker. He is assigned a project to test the security of are-secure Web site and receives the following error message: Microsoft OLE DB Provider for ODBC Drivers…

The correct answer is C. A SQL injection attack. The Microsoft OLE DB Provider for ODBC Drivers error is a classic indicator that unsanitized user input is being passed directly into a SQL query, revealing SQL injection vulnerability.

Web Application Attacks & Post-Exploitation

Question

John works as a professional Ethical Hacker. He is assigned a project to test the security of are-secure Web site and receives the following error message:

Microsoft OLE DB Provider for ODBC Drivers error '0x80040E14' This error message shows that the We-are-secure Website is vulnerable to __________.

Options

  • AA buffer overflow
  • BA Denial-of-Service attack
  • CA SQL injection attack
  • DAn XSS attack

How the community answered

(31 responses)
  • B
    6% (2)
  • C
    90% (28)
  • D
    3% (1)

Why each option

The Microsoft OLE DB Provider for ODBC Drivers error is a classic indicator that unsanitized user input is being passed directly into a SQL query, revealing SQL injection vulnerability.

AA buffer overflow

A buffer overflow results from writing data beyond allocated memory boundaries in an application, not from database driver error messages.

BA Denial-of-Service attack

A DoS attack aims to exhaust resources and deny service; it does not produce database-level OLE DB error messages.

CA SQL injection attackCorrect

The OLE DB/ODBC error message is generated when a malformed or unexpected string disrupts a backend SQL query, exposing the database driver to the attacker. This error leaks information about the database technology in use and confirms that input is not properly sanitized before being included in SQL statements. SQL injection exploits this weakness to manipulate queries, extract data, or execute commands.

DAn XSS attack

XSS attacks inject malicious scripts into web pages viewed by other users and do not trigger database driver errors.

Concept tested: SQL injection identification via database error messages

Source: https://owasp.org/www-community/attacks/SQL_Injection

Topics

#SQL injection#OLE DB error message#error-based SQLi#web vulnerability identification

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice