ECSA v10: EC-Council Certified Security Analyst v10

James is an attacker who intends to attack XYZ Inc. He has performed reconnaissance on all publicly available company resources and identified the official company website, http://xyz.com. He scanned every page of the company website for potential vulnerabilities to exploit. Finally, on the website's user-account login page, he found a user login form containing several fields that accept user input, such as a username and password. He also found that any non-validated query requested can be directly communicated to Active Directory, enabling unauthorized users to gain direct access to the databases. Since James knew an XYZ Inc. employee named Jason, he enters the valid username jason and injects jason)(&)) in the username field. In the password field, James enters blah and clicks the Submit button. Because the complete URL string entered by James becomes `(&(USER=jason)

(&))(PASS=blah)),only the first filter is processed by Microsoft Active Directory; that is, the query(&(USER=jason)(&))` is processed. Because this query always evaluates as true, James successfully logs in to Jason's user account without Jason's valid password.

In the scenario above, identify the type of attack James performed.