312-96: Certified Application Security Engineer (Java)

By ECCouncil · Question Mode

QuestionQ17

VerifiedSecure Coding Practices for Input Validation

A US-based ecommerce company has developed the website www.ec-sell.com to sell its products online. The website includes a feature that lets customers search for products by price. Recently, a bug-bounty participant discovered a security flaw on the Search page: they could view every product in the database table by changing the website URL from http://www.ec-sell.com/products.jsp?val=100 to http://www.ec-sell.com/products.jsp?val=200 OR '1'='1 -. The product.jsp page is vulnerable to

Explanation

SQL injection occurs when untrusted input is incorporated into a database query so that it changes the query’s meaning. An appended OR '1'='1 condition evaluates as true and can bypass the intended price filter, returning all product records.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!