Question

A particular malware threat looks for weaknesses in poorly coded Web application software that get exposed when the Web application fails to filter the data entered by a user on a Web page. This results in malicious program code entering into the company’s systems and networks. Which of the following best refers to this malware threat?

Answer 1

The malware threat is SQL Injection Attack.

When the web application fails to filter the data entered by user in certain input boxes, those unfiltered data can be used to execute malicious SQL statements which can affect the database. These malicious SQL statements make the web application to work differently compared to the intended behavior.

A simple example can be a login form. If the password field is not filtered, ' or 1 can be used to login into the first user account in the database. While comparing the password, or 1 makes it true in all cases. Hence the data should be filtered before using in SQL statements. Prepared statements should be used in SQL to avoid SQL Injection Attacks.