Question

When using a simple search function on a web site, an attacker notices that certain inputs causes an error message to be returned by the web server. What is a possible OWASP Top 10 vulnerability that may be present in the application?

Question 1 options:

	Broken Access Control
	Cross-Site Scripting
	Injection
	Sensitive Data Exposure
	Using Components with Known Vulnerabilities

Answer 1

When using a simple search function on a web site, an attacker notices that certain inputs causes an error message to be returned by the web server. What is a possible OWASP Top 10 vulnerability that may be present in the application?

Answer: Injection

SQL Injection is a method that allows perpetrators to execute malicious SQL statements and bypass application security measures to retrieve or alter database contents.

Others cannot be the answer as:

• XSS is a method that exploits website vulnerability by injecting scripts that will run at client’s side.
• Access control enforces policy such that users cannot act outside of their intended permissions.
• Sensitive Data Exposure occurs when an application does not adequately protect sensitive information.

OWASP stands for the Open Web Application Security Project, an online community that produces articles, methodologies, documentation, tools, and technologies in the field of web application security.