A building-permit web application concatenates citizen form fields directly into SQL statements, and testers can alter queries to return other applicants’ records. Which vulnerability type is this?
Select an answer to reveal the explanation.
Short Explanation
Gluing user text straight into SQL is SQL injection — the database starts taking orders from the form fields. That is a web app input flaw, not XSS cookie theft or a TOC/TOU race. Parameterize queries and validate input on municipal permit systems.
Full Explanation
SQL injection is a web-based vulnerability where untrusted input is interpreted as part of a database query, enabling unauthorized reads or changes. Objective 2.3 lists SQLi among web application vulnerability types. XSS, race conditions, and mobile jailbreaking are separate vulnerability classes. Permit systems handling citizen data should use parameterized queries, input validation, and least-privilege database accounts.