GCIH: GIAC Certified Incident HandlerDemo

By GIAC · Question Mode

QuestionQ490

Exploiting Insecure Web Application References

John is a professional Ethical Hacker assigned to test the security of www.weare-secure.com. He enters a single quote into the login-page input field of the We-are-secure website and receives this error message:

Microsoft OLE DB Provider for ODBC Drivers error '0x80040E14'

This error message indicates that the We-are-secure Website is vulnerable to __________.

  • A A buffer overflow
  • B A Denial-of-Service attack
  • C A SQL injection attack
  • D An XSS attack
Explanation

A database error triggered by a single quote shows that user-supplied input is likely reaching a SQL query without proper parameterization or escaping. An attacker can exploit that condition to alter the query, which is SQL injection.

Community Discussion

No comments yet. Be the first to start the discussion!