CompTIA DataSys+ (DS0-001)Data and Database SecurityMedium
A web application developer suspects that a recent increase in database errors and unexpected query results might be due to malicious input. The application takes user input directly from a web form and constructs SQL queries without proper sanitization. Which type of attack is MOST likely occurring?
- ASQL Injection
- BDenial of Service (DoS)
- CBrute-force attack
- DCross-Site Scripting (XSS)
Show answer & explanationAnswer & explanation
Correct answer: A. SQL Injection
SQL Injection attacks occur when an attacker inserts malicious SQL code into input fields, which is then executed by the database due to improper input sanitization, leading to unexpected errors or unauthorized data access.
Why the other options are wrong
- B. DoS attacks aim to make a service unavailable, typically by overwhelming it with traffic, not by manipulating SQL queries.
- C. Brute-force attacks try many passwords to gain access, not to manipulate database queries via input fields.
- D. XSS attacks inject client-side scripts into web pages, affecting users, not directly the database via query construction.
SQL Injection
A code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution.
- Exploits vulnerabilities in applications that construct SQL queries from unsanitized user input.
- Can lead to unauthorized data access, modification, or deletion, and even shell access.
- Mitigated by using parameterized queries, prepared statements, and input validation.
Memory trick: Bad input can break the database.