GSLC · Question #469
You have forgotten your password of an online shop. The web application of that online shop asks you to enter your email so that they can send you a new password. You enter your email [email protected]'…
The correct answer is D. You have entered any special character in email. The single quote appended to the email address is a special character that breaks server-side SQL query syntax, triggering a server error - a classic indicator of SQL injection vulnerability.
Question
You have forgotten your password of an online shop. The web application of that online shop asks you to enter your email so that they can send you a new password. You enter your email [email protected]' and press the submit button. The Web application displays the server error. What can be the reason of the error?
Options
- AThe remote server is down.
- BEmail entered is not valid.
- CYour internet connection is slow.
- DYou have entered any special character in email.
How the community answered
(60 responses)- A3% (2)
- B8% (5)
- C12% (7)
- D77% (46)
Why each option
The single quote appended to the email address is a special character that breaks server-side SQL query syntax, triggering a server error - a classic indicator of SQL injection vulnerability.
A downed remote server would produce a connection timeout or 'unreachable' error before the application even processes input, not an error triggered by specific characters typed into a field.
The base email '[email protected]' conforms to valid RFC 5321 email format; the problem is not email validity but the injected special character that corrupts the server-side query.
A slow internet connection causes latency or timeout errors during transmission, not a server-side processing error that is triggered only when a specific character is included in the input.
The email entered was '[email protected]'' which contains a single quote (apostrophe), a special character that terminates string literals in SQL. When the application passes this input directly into a database query without sanitization, it produces a SQL syntax error that surfaces as a server error.
Concept tested: SQL injection via unescaped special character input
Source: https://owasp.org/www-community/attacks/SQL_Injection
Topics
Community Discussion
No community discussion yet for this question.