MENU
A US-based ecommerce company has developed their website www.ec-sell.com to sell their products online. The website has a feature that allows their customer to search products based on the price. Recently, a bug bounty has discovered a security flaw in the Search page of the website, where he could see all products from the database table when he altered the website URL http://www.ec-sell.com/products.jsp?val=100 to http://www.ec-sell.com/products.jsp?val=200 OR '1'='1 -. The product.jsp page is vulnerable to
Suggested Answer: C
Get Premium 312-96 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
11 comments · newest first
BA
Bambi
11 months ago
Just wow, I can't believe they missed that in testing!
RI
Richelle
11 months ago
I thought brute force was the main concern here, but this makes sense.
VI
Victor
11 months ago
Wait, are we sure it's not a CSRF? Seems a bit off.
BR
Brandon
11 months ago
Totally agree, that URL manipulation is classic SQLi.
VI
Vinnie
12 months ago
That's definitely an SQL Injection vulnerability.
AJ
Aja
12 months ago
I thought brute force attacks were more about guessing passwords, so I'm leaning towards SQL Injection for this one.
PA
Patria
1 year ago
This reminds me of a practice question we did on SQL Injection. The way the query is altered looks like a classic case of that vulnerability.
LU
Ludivina
1 year ago
I'm not entirely sure, but I think this could also relate to session hijacking? I need to double-check my notes on that.
GE
Gerald
1 year ago
I remember studying SQL Injection attacks, and this URL manipulation seems to fit that description.
RI
Rima
1 year ago
I feel pretty confident about this. Applying the Standardized Service Contract, Redundant Implementation, and Service Data Replication patterns seems like a solid approach to address the performance and scalability concerns while also accommodating the new service capability.
LA
Lashandra
1 year ago
Hmm, I'm a bit unsure about this one. The options seem similar, and I want to make sure I understand the difference between solution scope, design, requirements, and the business case. Let me think this through step-by-step.