nerdexam
GIAC

GPEN · Question #379

John works as a professional Ethical Hacker. He is assigned a project to test the security of Weare- secure Web site and receives the following error message: Microsoft OLE DB Provider for ODBC…

The correct answer is A. A SQL injection attack. The Microsoft OLE DB Provider for ODBC Drivers error message reveals the database backend and is produced when unsanitized user input breaks a SQL query, confirming SQL injection vulnerability.

Web Application Penetration Testing

Question

John works as a professional Ethical Hacker. He is assigned a project to test the security of Weare- secure Web site and receives the following error message:

Microsoft OLE DB Provider for ODBC Drivers error '0x80040E14' This error message shows that the We-are-secure Website is vulnerable to __________.

Options

  • AA SQL injection attack
  • BA Denial-of-Service attack
  • CA buffer overflow
  • DAn XSS attack

How the community answered

(61 responses)
  • A
    82% (50)
  • B
    2% (1)
  • C
    5% (3)
  • D
    11% (7)

Why each option

The Microsoft OLE DB Provider for ODBC Drivers error message reveals the database backend and is produced when unsanitized user input breaks a SQL query, confirming SQL injection vulnerability.

AA SQL injection attackCorrect

This error is a classic SQL injection indicator because it exposes the underlying database provider (OLE DB/ODBC) and is triggered when attacker-supplied input is concatenated directly into a SQL query, causing a parse or execution error. SQL injection allows manipulation of backend database queries due to lack of input validation or parameterized queries.

BA Denial-of-Service attack

A Denial-of-Service attack overwhelms system resources and does not produce structured database provider error messages like OLE DB errors.

CA buffer overflow

Buffer overflow attacks corrupt process memory and generate memory access violations or crashes, not SQL provider-level database errors.

DAn XSS attack

Cross-site scripting (XSS) attacks inject client-side scripts into web page output and operate entirely on the client side, not at the server-side database provider layer.

Concept tested: SQL injection identification via database error messages

Source: https://owasp.org/www-community/attacks/SQL_Injection

Topics

#SQL injection#OLE DB error messages#database errors#web vulnerability

Community Discussion

No community discussion yet for this question.

Full GPEN Practice