Which vulnerability occurs when input from a client is not validated before being processed by the application?

Which vulnerability occurs when input from a client is not validated before being processed by the application?

• A. Unvalidated Inputs
• B. Web Service Attack
• C. Deserialization
• D. Cookie Snooping

Answer: (A)

When input from a client isn’t checked or sanitized before the application uses it, you have an input validation failure. The application trusts whatever comes in and processes it, which lets attackers send malformed or malicious data that can alter behavior, cause errors, or expose or modify data. Validating input means checking type, length, format, and range, and sanitizing or escaping data so it can’t be misused in queries, command execution, HTML rendering, or file access. That’s why this option is the best fit: it describes the general vulnerability caused by processing unvalidated input. The other terms describe different issues. A web service attack is a broad category of attacks against services rather than specifically about not validating input. Deserialization is a particular vulnerability that happens when untrusted data is turned into objects, which can be exploited, but it’s a more specific case of processing untrusted input. Cookie snooping refers to intercepting cookies, which is about confidentiality and access to cookies, not input validation.

When input from a client isn’t checked or sanitized before the application uses it, you have an input validation failure. The application trusts whatever comes in and processes it, which lets attackers send malformed or malicious data that can alter behavior, cause errors, or expose or modify data. Validating input means checking type, length, format, and range, and sanitizing or escaping data so it can’t be misused in queries, command execution, HTML rendering, or file access. That’s why this option is the best fit: it describes the general vulnerability caused by processing unvalidated input.

The other terms describe different issues. A web service attack is a broad category of attacks against services rather than specifically about not validating input. Deserialization is a particular vulnerability that happens when untrusted data is turned into objects, which can be exploited, but it’s a more specific case of processing untrusted input. Cookie snooping refers to intercepting cookies, which is about confidentiality and access to cookies, not input validation.