A citizen-comment portal reflects unsanitized input into pages other residents view, and a crafted script steals session cookies from those browsers. Which vulnerability is demonstrated?
Select an answer to reveal the explanation.
Short Explanation
If a comment box can run script in someone else’s browser and swipe cookies, that is XSS — the page becomes the attacker’s stage. It is not SQLi against the database engine or a poisoned vendor patch. Sanitize and encode output on civic portals.
Full Explanation
Cross-site scripting (XSS) injects script into pages other users view so that script runs in their browsers with the site’s origin privileges. A citizen-comment portal that reflects unsanitized input and allows crafted script to steal session cookies demonstrates reflected or stored XSS impacting other residents. The vulnerability is insufficient output encoding/sanitization on content rendered to browsers.
SQL injection that rewrites backend permit-database queries manipulates the database engine. Cookie theft via script in other users’ browsers is a client-side script injection problem, not SQL query rewriting.
Supply-chain insertion of a malicious vendor software update poisons a trusted distribution channel. The portal’s own comment handling is the flaw here, not a vendor build pipeline.
Unsupported Windows 7 kiosks on the DMV network are legacy/unpatchable endpoints. They are an OS support problem, not script injection in a comment page.
Exam caveat: XSS versus SQLi is a frequent trap—map "script in another user’s browser / cookie theft" to XSS and "altered database queries / dumped rows" to SQLi. Also recall stored versus reflected XSS; civic comment systems often imply stored XSS because other residents later view the content.
Operational check: encode output by context (HTML, attribute, JavaScript), sanitize rich text carefully, set HttpOnly and Secure on session cookies, consider Content-Security-Policy, and test civic portals with both authenticated and anonymous comment flows. Treat session cookies on resident portals as keys to identity theft and fraudulent submissions.