A penetration tester is assessing a web application and discovers that the application uses the document.write() function with user-controlled input reflected in the response without encoding. What vulnerability is present?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because DOM-based XSS occurs when JavaScript on the client side uses untrusted data in a dangerous sink like document.write() without encoding; an attacker can inject malicious JavaScript that executes in the victim's browser in the context of the target origin. A is wrong because document.write is a JavaScript DOM method, not an SQL interface; SQL injection targets database query construction.
Full explanation below image
Full Explanation
B is correct because DOM-based XSS occurs when JavaScript on the client side uses untrusted data in a dangerous sink like document.write() without encoding; an attacker can inject malicious JavaScript that executes in the victim's browser in the context of the target origin. A is wrong because document.write is a JavaScript DOM method, not an SQL interface; SQL injection targets database query construction. C is wrong because SSTI targets server-side template engines (Jinja2, Twig, etc.); document.write is client-side JavaScript. D is wrong because XXE exploits XML parsers processing external entity declarations; document.write is not an XML parser.