CEH Network and Web Application Attacks Practice Question

Exhibit

<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <getUserInfo>
      <userId>1 OR 1=1</userId>
    </getUserInfo>
  </soap:Body>
</soap:Envelope>

Response:
<soap:Envelope>
  <soap:Body>
    <getUserInfoResponse>
      <user>
        <id>1</id>
        <name>admin</name>
        <email>admin@test.com</email>
      </user>
      <user>
        <id>2</id>
        <name>user</name>
        <email>user@test.com</email>
      </user>
    </getUserInfoResponse>
  </soap:Body>
</soap:Envelope>

Refer to the exhibit. A penetration tester sends a SOAP request and receives multiple user records. Which vulnerability is present?

⚠ Common exam trap

EC-Council exams often test the distinction between XML-specific attacks (XXE) and injection attacks that target the underlying data layer (SQLi), so candidates mistakenly choose XXE when they see XML input, even though the symptom (multiple records returned) points to database manipulation, not file disclosure.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

SQL injection in SOAP service

The SOAP service returns multiple user records in response to a crafted request, indicating that the input is being interpolated into a database query without proper sanitization. This is classic SQL injection (SQLi) in a SOAP XML context, where an attacker can embed SQL payloads within XML elements (e.g., <username>admin' OR '1'='1</username>) to manipulate the backend SQL query and retrieve all records.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
SQL injection in SOAP service
Why this is correct
The exhibit demonstrates SQL injection in a SOAP service, as the `userId` parameter in the request contains the payload '1 OR 1=1'. This classic SQL injection technique manipulates the backend SQL query, causing the `WHERE` clause to always evaluate to true. Consequently, the application returns all user records, bypassing intended access controls and confirming the vulnerability.
✗
XML External Entity (XXE) injection
Why it's wrong here
XML External Entity (XXE) injection exploits vulnerabilities in XML parsers that process external entities referenced within a Document Type Definition (DTD). Attackers can craft malicious XML to read arbitrary files from the server's file system, perform Server-Side Request Forgery (SSRF), or launch denial-of-service attacks. This attack vector specifically targets XML processing capabilities, distinct from manipulating database queries through parameter values.
✗
Cross-site scripting (XSS)
Why it's wrong here
Cross-site scripting (XSS) is a client-side code injection attack where malicious scripts are injected into trusted websites, typically targeting other users' browsers. These scripts execute within the victim's browser context, allowing attackers to steal session cookies, deface web pages, or redirect users to malicious sites. XSS fundamentally operates on the client side, manipulating browser behavior rather than directly compromising backend server databases via SQL queries.
✗
Command injection
Why it's wrong here
Command injection involves executing arbitrary operating system commands on the host server by injecting them into user-supplied input that is then passed to a system shell. This vulnerability allows an attacker to compromise the underlying server, execute programs, or manipulate files, leading to full system control. Unlike SQL injection, which targets database queries, command injection specifically exploits the application's interaction with the server's operating system.

Go deeper

CEH Network and Web Application Attacks Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question