CS0-003 Vulnerability Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use of a component with known vulnerabilities

  Why it's wrong here

  This issue falls under 'Vulnerable and Outdated Components' (A06:2021), not an injection attack. Using a library or module with known Common Vulnerabilities and Exposures (CVEs) means the application inherits those flaws, but an attacker must still trigger the vulnerable code path. Unlike XSS or SQLi, this isn't about sending crafted payloads into user-supplied input; it's a supply-chain hygiene failure that leads to exposure of a pre-existing bug.

• ✗

  Broken access control allowing privilege escalation

  Why it's wrong here

  Broken access control (A01:2021) is a separate authorization flaw where an application fails to enforce proper restrictions on what authenticated users can do. This often manifests as horizontal or vertical privilege escalation, such as tampering with a URL parameter or role ID to gain admin rights. It is not an injection vulnerability, because no malicious input is assembled into a script or query; the attack simply exploits missing server-side policy checks.

• ✓

  Stored XSS in the comment section

  Why this is correct

  Stored XSS in the comment section is an injection vulnerability because the attacker injects executable client-side script (e.g., JavaScript) that is persisted on the server and later rendered in other users' browsers. Unlike SQL injection, which targets the database layer with structured query language, XSS targets the interpretation context of HTML/JavaScript in the victim's browser. The comment field fails to sanitize or encode user input, enabling script execution that can steal session cookies, deface pages, or perform actions on behalf of the target user.

• ✗

  Security misconfiguration exposing directory listing

  Why it's wrong here

  Security misconfiguration (A05:2021) is an infrastructure or application configuration error, such as enabling directory listing on a web server, leaving default credentials, or verbose error messages. This exposes sensitive files or metadata to anyone who requests the directory, but it does not involve injecting code or queries. It is a static condition that reflects omitted hardening, not an active attack technique; the information disclosure it causes can aid further attacks but is not itself an injection flaw.

• ✓

  SQL injection in the login form

  Why this is correct

  SQL injection in the login form is a direct injection vulnerability because attacker-supplied data is concatenated into a SQL query without parameterized statements. By inserting malicious SQL payloads (e.g., ' OR 1=1 --), an attacker can bypass authentication, alter records, or dump the database. This is distinct from XSS, which targets the browser with scripts; SQLi targets the backend database engine and manipulates query logic, often with catastrophic confidentiality and integrity impact.

Go deeper

Related to this question