A security team reviews a penetration testing report of a web application that contains multiple cross-site scripting (XSS) and Structured Query Language injection (SQLi) vulnerabilities.
Which of the following is most likely causing these to occur?
A.
Misconfigured web application firewall (WAF)
B.
Lack of secure input validation
C.
Lack of a Hypertext Transfer Protocol (HTTP) Strict Transport Security (HSTS) header
The common underlying weakness is insufficient handling and validation of untrusted application input . XSS occurs when attacker-controlled content is processed and subsequently rendered in a manner that allows script execution. SQL injection occurs when untrusted values become part of database commands without appropriate separation between code and data.
OWASP recommends validating untrusted input early in the processing workflow and applying syntactic and semantic validation. For SQL injection specifically, OWASP identifies parameterized queries as the primary defensive technique and recommends allow-list input validation as an additional defensive layer. For XSS, context-appropriate output encoding and sanitization must also be applied; therefore input validation should be viewed as part of secure application handling rather than the sole technical control.
A WAF can provide defense in depth but does not correct vulnerable application code. HSTS forces browsers to use HTTPS and protects transport security; it does not prevent malicious input from being interpreted by an application. Endpoint protection similarly operates on hosts and does not repair web application data-handling flaws.
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit