Exam 312-50v11 topic 1 question 383 discussion

Actual exam question from ECCouncil's 312-50v11

Question #: 383
Topic #: 1

Calvin, a software developer, uses a feature that helps him auto-generate the content of a web page without manual involvement and is integrated with SSI directives. This leads to a vulnerability in the developed web application as this feature accepts remote user inputs and uses them on the page. Hackers can exploit this feature and pass malicious SSI directives as input values to perform malicious activities such as modifying and erasing server files.
What is the type of injection attack Calvin's web application is susceptible to?

A. CRLF injection
B. Server-side template injection
C. Server-side JS injection
D. Server-side includes injection

Show Suggested Answer

Suggested Answer: D 🗳️

by jinjection at Sept. 28, 2021, 9:53 a.m.

Comments

Submit Cancel

blacksheep6r

Highly Voted 1 year, 8 months ago

Server-side Includes is an application feature that helps designers to auto-generate the content of the web page without manual involvement Attackers exploit this feature to pass malicious SSI directives as input values and perform malicious activities

upvoted 8 times

...

Daniel8660

Most Recent 8 months, 1 week ago

Selected Answer: D

Web Application Threats - A1 - Injection Flaws Other Injection Attacks - Server-Side Includes Injection Server-side Includes is an application feature that helps designers to auto-generate the content of the web page without manual involvement.Attackers launch server-side injection attacks to take control over web applications integrated with SSI directives. Attackers exploit this feature and pass malicious SSI directives as input values to perform malicious activities such as modifying and erasing server files, running shell commands, and taking control over critical files such as “/etc/passwd”. (P.1756/1740)

upvoted 2 times

...

pyw

1 year ago

answer is IN the question

upvoted 3 times

...

jinjection

1 year, 8 months ago

correct

upvoted 4 times

...