CISSP: Certified Information Systems Security Professional

Question

While reviewing the security logs, the password displayed for an administrative login event was ' OR ' '1'='1' --. This is an example of which of the following attack types?

Explanation

SQL injection inserts SQL syntax into application input so that a database interprets the input as part of a query. The OR true condition can bypass an authentication predicate, and -- comments out the remaining query text.

Learn more

CISSP: Certified Information Systems Security Professional

AstroTutor

Notes

Readiness

QuestionQ281

Community Discussion