A penetration test finds a web application reflecting user input directly into HTTP response headers without sanitization. Which vulnerability class does this represent and what is the primary risk?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — when user input goes straight into HTTP response headers without sanitization, you're looking at HTTP response splitting and header injection. Attackers can use CR/LF characters to split the response, inject headers, hijack sessions, poison caches, or run scripts.
Full Explanation
The correct vulnerability class is HTTP response splitting and header injection because unsanitized user input injected into HTTP response headers — particularly content containing CR/LF characters — allows attackers to split the HTTP response, inject arbitrary headers, set cookies for session hijacking, redirect users, or inject scripts. The SQL injection option is wrong because SQL injection requires unsanitized input passed to database queries, not HTTP headers. The XML External Entity injection option is wrong because XML External Entity injection requires XML parsing of user-supplied content. The buffer overflow option is wrong because buffer overflows occur in memory management code, not in HTTP header handling at the application layer.