Web Application Attacks and OWASP Top 10 CEH Practice Questions (Page 13)

Questions 61–61

1. 61application · medium

   A penetration tester is assessing a web application that uses a search feature. The tester submits the following input in the search field: ' OR 1=1 -- and receives the entire user table in the response. The application is built with a modern ORM and parameterized queries for all database access. Which of the following is the most likely reason the injection succeeded?

   • AThe database user account has excessive privileges, allowing the SELECT to return the entire table.
   • BThe search feature concatenates user input into a raw SQL query instead of using the ORM's parameterized methods.
   • CThe application fails to validate that the search input contains only alphanumeric characters.
   • DThe ORM library has a known SQL injection vulnerability in its query builder.
   Reveal Solution Discussion Select an answer first