Remote Code Execution (RCE) WAHS Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a classic example of code injection in a server-side scripting language?

   • APassing `system('id')` to a PHP `eval()` function that processes user-supplied input.
   • BPassing `<script>alert(1)</script>` to a stored comment field.
   • CPassing `'; DROP TABLE users; --` to a SQL query.
   • DPassing `../../etc/passwd` to a file inclusion parameter.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A web application uses a SQL query to fetch a user's profile: `SELECT * FROM users WHERE id = <input>`. The application is vulnerable to SQL injection, and the database user has `FILE` privilege. The tester wants to achieve RCE by writing a web shell to the web root. Which SQL injection technique is most appropriate?

   • AUse `LOAD_FILE` to read the web root path.
   • BUse `UNION SELECT` to inject a `SELECT ... INTO OUTFILE` statement.
   • CUse `xp_cmdshell` to execute a command.
   • DUse a time-based blind SQL injection to enumerate the database.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is an effective mitigation against file upload-based RCE?

   • AStoring uploaded files outside the web root and serving them through a script that enforces content-type checks.
   • BRenaming uploaded files to a random name without changing the extension.
   • CAllowing only image file extensions but not checking the file content.
   • DStoring uploaded files in a database as BLOBs and retrieving them with a script.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A PHP application has a template engine that allows users to submit custom templates. The application uses `eval()` to render the templates. An attacker submits a template containing `system('id')` and the output is displayed. Which remediation is the most effective?

   • ARun the template rendering in a separate Docker container with limited privileges.
   • BFilter the template input to remove parentheses and semicolons.
   • CUse a sandboxed template engine that does not allow arbitrary code execution.
   • DDisable dangerous PHP functions like `system()` in the PHP configuration.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is a common language-specific function that can be exploited for insecure deserialization?

   • ASQL's `SELECT` statement.
   • BHTML's `<script>` tag.
   • CJavaScript's `JSON.parse()` function.
   • DPHP's `unserialize()` function when used on user-controlled input.
   Reveal Solution Discussion Select an answer first