Injection category identification?

Injection category identification?

• A. SQL Injection
• B. Buffer Overflow
• C. Insecure Cryptographic Storage
• D. Improper Error Handling

Answer: (A)

Injection flaws happen when untrusted input is treated as code or a command by an interpreter. In the database scenario, that means building a SQL statement by concatenating user input, and then sending it to the database for execution. If the input isn’t properly sanitized or parameterized, an attacker can modify the intended query to access or modify data, bypass authentication, or perform other unauthorized actions. SQL Injection is the classic and most representative form of this vulnerability, since it directly involves injecting SQL code into a query that the database will execute. The other options describe different types of vulnerabilities. A buffer overflow is about exceeding memory bounds and corrupting memory, not injecting commands into a database. Insecure cryptographic storage concerns problems with how data is encrypted or stored, not how inputs are used in queries. Improper error handling deals with leaking information or exposing internal details through errors, not injecting commands.

Injection flaws happen when untrusted input is treated as code or a command by an interpreter. In the database scenario, that means building a SQL statement by concatenating user input, and then sending it to the database for execution. If the input isn’t properly sanitized or parameterized, an attacker can modify the intended query to access or modify data, bypass authentication, or perform other unauthorized actions. SQL Injection is the classic and most representative form of this vulnerability, since it directly involves injecting SQL code into a query that the database will execute.

The other options describe different types of vulnerabilities. A buffer overflow is about exceeding memory bounds and corrupting memory, not injecting commands into a database. Insecure cryptographic storage concerns problems with how data is encrypted or stored, not how inputs are used in queries. Improper error handling deals with leaking information or exposing internal details through errors, not injecting commands.