A building-permit web application concatenates citizen form fields directly into SQL statements, and testers can alter queries to return other applicants’ records. Which vulnerability type is this?
Select an answer to reveal the explanation.
Short Explanation
Gluing user text straight into SQL is SQL injection — the database starts taking orders from the form fields. That is a web app input flaw, not XSS cookie theft or a TOC/TOU race. Parameterize queries and validate input on municipal permit systems.
Full Explanation
SQL injection occurs when untrusted input is incorporated into database queries such that the database engine interprets attacker-controlled fragments as SQL. Concatenating citizen form fields directly into statements on a building-permit application lets testers alter queries and return other applicants’ records—classic confidentiality impact via query tampering. Parameterized queries, ORMs with bind variables, and strict input validation are the primary defenses.
Cross-site scripting that steals session cookies runs in the victim’s browser after script is reflected or stored in pages. SQLi targets the database layer; XSS targets other users’ browsers. Returning other applicants’ records through altered SQL is not cookie theft via script.
A time-of-check/time-of-use race exploits a timing gap between permission check and use of a file or resource. That concurrency bug is unrelated to concatenating form fields into SQL.
Jailbreaking that bypasses MDM on city tablets is a mobile control-evasion issue. It does not describe web-form input reaching a SQL engine.
Exam caveat: SQLi is identified by untrusted input influencing query structure or logic. Blind, union-based, and error-based variants are still SQLi. Do not pick XSS merely because the app is web-facing; follow whether the impact is database query manipulation versus script in another user’s browser.
Operational check on municipal permit systems: eliminate string-built SQL, use prepared statements, apply least-privilege database accounts for the app tier, enable WAF rules as defense-in-depth, and include authenticated SQLi tests in every release. Protect applicant PII as regulated civic data subject to breach notification if queries can pull others’ records.