Exploiting Insecure Web Application References GCIH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A web application uses URLs like /download?file=invoice_123.pdf to let users retrieve their own invoices. An attacker changes the file parameter to invoice_124.pdf and successfully downloads another user's invoice. Which vulnerability is being exploited?

   • ACross-Site Scripting (XSS)
   • BCross-Site Request Forgery (CSRF)
   • CSQL Injection
   • DInsecure Direct Object Reference (IDOR)
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A banking application allows users to transfer money by submitting a form with the fields from_account, to_account, and amount. A user discovers that by changing the from_account parameter to another user's account number, the transfer is deducted from that account. Which of the following is the most appropriate fix?

   • ARequire the user to re-enter their password for each transfer.
   • BAdd a hidden field with the user's account number and validate it on the server.
   • CIgnore the from_account parameter and use the authenticated user's account number from the server-side session.
   • DEncrypt the from_account parameter so that the client cannot modify it.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A ticketing system allows users to transfer tickets by submitting a form with hidden fields: 'ticket_id' and 'owner_id'. A user changes the 'owner_id' to another user's ID and successfully transfers a ticket they do not own. Which of the following is the most effective mitigation?

   • AOn the server, verify that the logged-in user is the current owner of the ticket before processing the transfer.
   • BAdd a CAPTCHA to the transfer form to slow down automated attacks.
   • CUse a random token for each ticket that is hard to guess.
   • DRemove the 'owner_id' field from the form and set it server-side based on the session.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large enterprise runs a legacy customer portal that exposes customer records via /customer?id=123. The portal is used by support agents and customers. Support agents have a separate admin interface, but the /customer endpoint is shared. A recent audit found that any authenticated user can access any customer record by changing the ID. The team must fix this without breaking the support agents' ability to access records on behalf of customers. Which solution best addresses the vulnerability while preserving the required functionality?

   • AImplement a server-side authorization layer that checks whether the authenticated user is either the customer associated with the record or a support agent with an explicit 'agent' role.
   • BReplace the numeric ID with a random UUID and keep the current access logic.
   • CMove the customer portal to a separate domain and require a different login for customers.
   • DAdd a rate limit to the /customer endpoint to slow down enumeration attempts.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company's internal web application uses a header 'X-User-Role' to determine if a user is an administrator. The application is behind a reverse proxy that strips this header from external requests, but internal requests from the corporate network are allowed to set it. An attacker on the corporate network discovers they can set 'X-User-Role: admin' and gain admin access. The company wants to maintain the ability for internal users to access the application without a VPN, but must prevent this bypass. Which solution is most effective?

   • AUse a WAF to block requests that contain the 'X-User-Role' header.
   • BEncrypt the header value with a shared secret.
   • CConfigure the reverse proxy to always overwrite the 'X-User-Role' header with a value derived from the authenticated session, regardless of the client-supplied value.
   • DBlock all internal network traffic to the application and require VPN access.
   Reveal Solution Discussion Select an answer first