A penetration tester has performed a vulnerability scan of a specific host that contains a valuable database and has identified the following vulnerabilities: XSS HTTP DELETE method allowed SQL…

SQL injection is a critical vulnerability enabling data exfiltration and modification, but exploiting it requires crafting specific payloads and navigating query logic, whereas an enabled HTTP DELETE method can destroy data with a single direct request.

When the HTTP DELETE method is enabled on a server hosting a valuable database, an attacker can issue DELETE requests to permanently remove database records, tables, or entire resources without requiring complex application-layer exploitation. This directly threatens data availability and integrity in a single request, making it the most immediately destructive vulnerability on a host where data preservation is the primary concern. The remaining vulnerabilities each require additional steps or user interaction to cause equivalent damage.

CSRF is a client-side attack that requires tricking an authenticated user into executing an unwanted action and cannot be directly leveraged against a database without user interaction, making it lower priority than a server-enabled destructive method.

XSS attacks execute malicious scripts in a victim's browser and require user interaction to trigger; they do not directly threaten the integrity or availability of the database stored on the server.