On a retailer product-search page, a parameter contains a quote and a database keyword, and the response includes rows that belong to a different customer. Which attack is this?
Select an answer to reveal the explanation.
Short Explanation
A forged line on an order form can make the clerk hand over someone else's box. You are looking at SQL injection that changed the database query. The trap is calling those extra customer rows a shell command, a browser script, or a SYN flood.
Full Explanation
The right selection is "SQL injection, where a quote and a database keyword change the query so another customer's rows return". The parameter alters a database statement, and the proof is in the response: rows that belong to another customer come back. A quote and a database keyword are the shape of that altered query. The statement "Command injection, sending the search parameter into a shell on the retailer web server" would hand the parameter to a shell and the response would be operating-system output, such as a directory listing, not another customer's table rows. The statement "Cross-site scripting, running the search parameter as a script inside a shopper browser" would run in a shopper's browser, and it would not by itself query the database and return a different customer's rows. The statement "A SYN flood against the search page, exhausting connection slots before any product rows return" would stop the page from answering, rather than return extra rows. Exam caveat: one parameter can be probed for more than one injection type, and rows from another customer are the sign the database query changed. Operational check: review the application query record for that search and confirm the quote and keyword were concatenated into the statement.