An attack relying on unvalidated input or file injection into the application.

An attack relying on unvalidated input or file injection into the application.

• A. Unvalidated Input and File Injection Attacks
• B. Command Injection Attacks
• C. Cookie Tampering
• D. Web Cache Poisoning Attack

Answer: (A)

The idea being tested is injection through unvalidated input and file handling. When an application accepts data from users and uses it to build commands, queries, or file operations without proper validation or sanitization, an attacker can craft input that alters the intended behavior or writes malicious content to files. This broad category covers both input that isn’t checked and file operations where user-supplied data is used to name or create files, allowing exploitation. This choice is the best fit because it explicitly describes both unvalidated input and the possibility of injecting into files, which is the essence of these vulnerabilities. The other options describe specific attacks that don’t align with the broad unvalidated-input/file-injection idea: a command-injection attack is a type of injection focused on executing system commands, cookie tampering targets client-side cookies, and web cache poisoning manipulates cached responses.

The idea being tested is injection through unvalidated input and file handling. When an application accepts data from users and uses it to build commands, queries, or file operations without proper validation or sanitization, an attacker can craft input that alters the intended behavior or writes malicious content to files. This broad category covers both input that isn’t checked and file operations where user-supplied data is used to name or create files, allowing exploitation.

This choice is the best fit because it explicitly describes both unvalidated input and the possibility of injecting into files, which is the essence of these vulnerabilities.

The other options describe specific attacks that don’t align with the broad unvalidated-input/file-injection idea: a command-injection attack is a type of injection focused on executing system commands, cookie tampering targets client-side cookies, and web cache poisoning manipulates cached responses.