A penetration tester is assessing a web application and discovers that the application uses the document.write() function with user-controlled input reflected in the response without encoding. What vulnerability is present?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — DOM-based Cross-Site Scripting (XSS) is the right answer because document.write() is a dangerous client-side sink. If user-controlled input reaches it without encoding, you can inject JavaScript that runs in the victim's browser in the context of the target origin.
Full Explanation
The DOM-based Cross-Site Scripting (XSS) answer is correct because DOM-based XSS occurs when JavaScript on the client side uses untrusted data in a dangerous sink like document.write() without encoding; an attacker can inject malicious JavaScript that executes in the victim's browser in the context of the target origin. The SQL injection answer is wrong because document.write is a JavaScript DOM method, not an SQL interface; SQL injection targets database query construction. The Server-Side Template Injection (SSTI) answer is wrong because SSTI targets server-side template engines (Jinja2, Twig, etc.); document.write is client-side JavaScript. The XML External Entity (XXE) injection answer is wrong because XXE exploits XML parsers processing external entity declarations; document.write is not an XML parser.