CHFI Application, Email and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cross-site scripting (XSS)

  Why it's wrong here

  Cross-site scripting (XSS) is a client-side vulnerability that occurs when an application reflects unsanitized user input into a web page, allowing an attacker to inject executable JavaScript (typically via <script> tags or event handlers) that runs in a victim's browser. The observed payload '1' OR '1'='1' contains no HTML, JavaScript, or event-handler syntax, and it is submitted as a parameter value to a server-side process rather than being stored or reflected as page content. Because the injection target is the backend database query instead of the browser DOM, this entry cannot be classified as XSS, even though both stem from inadequate input validation.

• ✓

  SQL injection

  Why this is correct

  SQL injection occurs when attacker-controlled input is concatenated directly into a SQL statement without parameterization, changing the query's logic. The literal payload '1' OR '1'='1' is a textbook tautology: if placed in a WHERE clause (e.g., WHERE user='admin' AND password='1' OR '1'='1'), it evaluates TRUE for every row, allowing authentication bypass or data exfiltration. Web application firewalls often flag this exact pattern, and the correct remediation is prepared statements/parameterized queries, strict input validation, and least-privilege database accounts.

• ✗

  Path traversal

  Why it's wrong here

  Path traversal (directory traversal) abuses insufficiently sanitized file-path inputs by injecting sequences like ../ or absolute paths to read files outside the web root, such as /etc/passwd on Linux or ..\..\windows\win.ini on Windows. The Apache log entry instead contains an SQL tautology in a parameter that is likely bound to a database query, not a filename or filesystem path. No dot-dot-slash sequences or file system constructs appear, so the attack is targeting the SQL layer, not the file retrieval mechanism.

• ✗

  Command injection

  Why it's wrong here

  Command injection exploits improper sanitization of input that is passed to an operating system shell, allowing an attacker to append commands using delimiters like ;, &&, |, or backticks, such as 'id; ls -la' in a vulnerable CGI script. The payload '1' OR '1'='1' uses SQL operators and numeric literals rather than shell metacharacters or OS command names, and it would not be interpreted as a command by a shell. Even if the input reaches a database, database engines do not execute OS commands through SQL expressions unless deliberately invoked via features like xp_cmdshell—which is not triggered by this tautology.

Go deeper

Related to this question