Which attack is performed by supplying an unvalidated input or by injecting files into a web application?

Which attack is performed by supplying an unvalidated input or by injecting files into a web application?

• A. Command Injection Attacks
• B. Unvalidated Input and File Injection Attacks
• C. HTTP Response Splitting Attack
• D. Web Cache Poisoning Attack

Answer: (B)

Unvalidated input and file injection attacks rely on a web application accepting user-supplied data without proper validation or sanitization and then using that data to influence the app’s behavior or file handling. When input isn’t checked, an attacker can craft data that changes what the application does, potentially executing commands, loading unexpected files, or reading or writing sensitive information. File injection specifically targets the ability to include or reference files based on user input, which can lead to code execution, disclosure, or manipulation of the app’s logic. This umbrella category fits best because it directly describes both parts of the scenario: unvalidated input that the app trusts, and the injection of files or file paths that the app processes. While other options describe legitimate attack techniques (such as executing commands through bad input, or manipulating HTTP headers and caches), they don’t capture the combined idea of unvalidated input and file inclusion/injection as precisely.

Unvalidated input and file injection attacks rely on a web application accepting user-supplied data without proper validation or sanitization and then using that data to influence the app’s behavior or file handling. When input isn’t checked, an attacker can craft data that changes what the application does, potentially executing commands, loading unexpected files, or reading or writing sensitive information. File injection specifically targets the ability to include or reference files based on user input, which can lead to code execution, disclosure, or manipulation of the app’s logic.

This umbrella category fits best because it directly describes both parts of the scenario: unvalidated input that the app trusts, and the injection of files or file paths that the app processes. While other options describe legitimate attack techniques (such as executing commands through bad input, or manipulating HTTP headers and caches), they don’t capture the combined idea of unvalidated input and file inclusion/injection as precisely.