A transit UNION-based SQL injection could return citizen PII. How should the tester demonstrate impact responsibly?
Select an answer to reveal the explanation.
Short Explanation
You can show the door opens without carting out every citizen’s file cabinet. Pull the smallest safe proof, redact in the report where you can, and leave the bulk PII alone. Read-only does not mean consequence-free when the data is people.
Full Explanation
Demonstrating SQL injection impact should follow least-data principles: enough rows or fields to prove unauthorized read capability without mass-exfiltrating personal information. Bulk exports to unmanaged storage and sharing raw PII outside authorized channels violate professional and often legal expectations. Read-only queries can still cause serious privacy harm. Reports should describe impact with minimal necessary evidence and appropriate redaction.