A penetration test finds a web application reflecting user input directly into HTTP response headers without sanitization. Which vulnerability class does this represent and what is the primary risk?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — d is correct because unsanitized user input injected into HTTP response headers — particularly content containing CR/LF characters — allows attackers to split the HTTP response, inject arbitrary headers, set cookies for session hijacking, redirect users, or inject scripts. A is wrong because SQL injection requires unsanitized input passed to database queries, not HTTP headers.
Full explanation below image
Full Explanation
D is correct because unsanitized user input injected into HTTP response headers — particularly content containing CR/LF characters — allows attackers to split the HTTP response, inject arbitrary headers, set cookies for session hijacking, redirect users, or inject scripts. A is wrong because SQL injection requires unsanitized input passed to database queries, not HTTP headers. C is wrong because XXE requires XML parsing of user-supplied content. B is wrong because buffer overflows occur in memory management code, not in HTTP header handling at the application layer.