Web application vulnerabilities that allow untrusted data to be interpreted and executed as part of a command or query.

Web application vulnerabilities that allow untrusted data to be interpreted and executed as part of a command or query.

• A. Injection flaws
• B. Vulnerability stack
• C. SOAP
• D. RESTful

Answer: (A)

Injection flaws happen when untrusted user-supplied data is allowed to alter or become part of a command or query that the application sends to a backend system. If the app builds commands or SQL statements by concatenating input directly, an attacker can craft input that changes the intended logic—giving them access to data, enabling data modification, or even executing arbitrary commands. SQL injection is the classic example, where malicious input manipulates a database query to bypass authentication or exfiltrate data. The same idea applies to other contexts like OS command execution, LDAP lookups, or XPath queries, where user data is interpreted as part of the instruction rather than as mere data. The key characteristic is that the input is treated as code or command within the backend's process. Preventive measures include using parameterized queries or prepared statements, rigorous input validation and escaping, and enforcing least-privilege accounts so a compromised query can’t cause broader damage. By contrast, SOAP and RESTful describe how data is communicated or structured, not how inputs are executed, and the remaining option isn’t a recognized category of vulnerability.

Injection flaws happen when untrusted user-supplied data is allowed to alter or become part of a command or query that the application sends to a backend system. If the app builds commands or SQL statements by concatenating input directly, an attacker can craft input that changes the intended logic—giving them access to data, enabling data modification, or even executing arbitrary commands. SQL injection is the classic example, where malicious input manipulates a database query to bypass authentication or exfiltrate data. The same idea applies to other contexts like OS command execution, LDAP lookups, or XPath queries, where user data is interpreted as part of the instruction rather than as mere data. The key characteristic is that the input is treated as code or command within the backend's process. Preventive measures include using parameterized queries or prepared statements, rigorous input validation and escaping, and enforcing least-privilege accounts so a compromised query can’t cause broader damage. By contrast, SOAP and RESTful describe how data is communicated or structured, not how inputs are executed, and the remaining option isn’t a recognized category of vulnerability.