ITPEC FE Morning April 2022 Question 36

SQL Injection — direct consequences — unauthorized access to database data beyond what the web application exposes.

SQL injection exploits input fields to inject malicious SQL into queries executed by the web server's database.

Direct results:
- Data that is on the web server but is not accessible via the web application is retrieved or modified
- Attacker can read, modify, or delete database records
- In severe cases: full database dump, authentication bypass, or remote code execution

Why not others:
- (a) Data packets modified — describes a man-in-the-middle (MITM) attack, not SQL injection
- (c) Keystrokes captured — describes a keylogger attack
- (d) IP headers captured and modified — describes packet sniffing or IP spoofing

Key rule: SQL injection targets the database layer through the web application's input handling, not the network layer.

AI-generated — may contain errors