ITPEC FE Morning October 2020 Question 38

Entering a malicious query command through a vulnerable web application to read or falsify data — SQL injection makes the database run SQL the attacker wrote.

If an application builds an SQL statement by pasting user input straight into it, input such as ' OR '1'='1 changes the statement's meaning, for example turning a login check into a query that matches every row. The attacker can then read, alter or delete data without authorisation. The defence is to pass input through placeholders (prepared statements) or escape it, so it is always treated as data, never as SQL.

Answer (a)

Why not others:

• •(b) — a worm that exploits a DBMS vulnerability to spread from server to server and flood the Internet with traffic, as SQL Slammer did; no query is injected through a web form
• •(c) — a script sent to a site that echoes visitors' input and then runs in another visitor's browser is cross-site scripting (XSS)
• •(d) — a page with an embedded script that makes the visitor perform an unintended operation on another site is cross-site request forgery (CSRF)

Key rule: Name web attacks by their target: SQL injection attacks the database, XSS the visitor's browser, CSRF the visitor's logged-in session on another site.

Security · AI-written, may contain errors