Which vulnerability is described by injecting malicious scripts into trusted websites to be executed by other users?

Which vulnerability is described by injecting malicious scripts into trusted websites to be executed by other users?

• A. Cross-site scripting (XSS)
• B. Cross-site request forgery (CSRF)
• C. Broken authentication
• D. Improper access control

Answer: (A)

Cross-site scripting is when an attacker injects malicious scripts into pages that other users trust, causing those scripts to run in the victims’ browsers within the site’s context. This happens because the site displays user-provided content without proper encoding or sanitization, so the injected script is treated as legitimate code by the browser. Once executed, the script can steal session cookies or tokens, capture input, or perform actions on behalf of the user, making it a potent way to compromise users who trust the site. Knowing this, you’ll see why this vulnerability specifically involves injecting and executing code on trusted pages for other users, unlike other flaws that revolve around impersonation, forged requests, or improper permission checks. Cross-site request forgery, for example, relies on tricking a user into sending a request to a site they’re already authenticated to, rather than injecting and running code in pages viewed by others. Broken authentication concerns weaknesses in confirming identity and maintaining sessions, not script execution. Improper access control is about failing to enforce authorizations, also separate from script injection.

Cross-site scripting is when an attacker injects malicious scripts into pages that other users trust, causing those scripts to run in the victims’ browsers within the site’s context. This happens because the site displays user-provided content without proper encoding or sanitization, so the injected script is treated as legitimate code by the browser. Once executed, the script can steal session cookies or tokens, capture input, or perform actions on behalf of the user, making it a potent way to compromise users who trust the site. Knowing this, you’ll see why this vulnerability specifically involves injecting and executing code on trusted pages for other users, unlike other flaws that revolve around impersonation, forged requests, or improper permission checks. Cross-site request forgery, for example, relies on tricking a user into sending a request to a site they’re already authenticated to, rather than injecting and running code in pages viewed by others. Broken authentication concerns weaknesses in confirming identity and maintaining sessions, not script execution. Improper access control is about failing to enforce authorizations, also separate from script injection.