CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cross-Site Scripting (XSS) and CSRF

  Why it's wrong here

  Cross-Site Scripting (XSS) involves injecting malicious client-side scripts into web pages viewed by other users, typically exploiting improper input validation in displayed content. Cross-Site Request Forgery (CSRF) tricks authenticated users into executing unwanted actions on a web application by sending forged requests. Neither of these attack types directly involves the server-side processing of uploaded files or manipulating file system paths, making them unrelated to the scenario described.

• ✗

  Local File Inclusion (LFI) and Remote File Inclusion (RFI)

  Why it's wrong here

  Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities allow an attacker to include arbitrary files, either from the local server's file system or a remote URL, respectively, into the server's execution context. While these can sometimes be chained with file upload vulnerabilities, the core mechanism described in the question—uploading a file with a path manipulation in its name—is about *writing* a file to an arbitrary location, not *including* an existing file for execution or display. The scenario focuses on the upload process itself.

• ✓

  Directory traversal and unrestricted file upload

  Why this is correct

  The ability to upload a file with a filename containing path traversal sequences (e.g., `../../`) directly exploits a directory traversal vulnerability, allowing the attacker to write the file to an arbitrary location outside the intended upload directory. Concurrently, the successful upload of a PHP file, which is a server-side script, indicates an unrestricted file upload vulnerability. This means the application lacks proper validation to prevent dangerous file types from being uploaded, enabling potential remote code execution.

• ✗

  SQL injection and command injection

  Why it's wrong here

  SQL injection attacks exploit vulnerabilities in database queries, allowing attackers to manipulate or extract data by injecting malicious SQL code into input fields. Command injection, conversely, allows an attacker to execute arbitrary operating system commands on the server by injecting them into inputs that are subsequently passed to a system shell. The scenario exclusively describes file upload mechanisms and path manipulation, with no indication of database interaction or direct operating system command execution.

Go deeper

Related to this question