GCIH Web App Injection Attacks Practice Question
An incident responder investigates a web application running a legacy PHP backend. Users report that searching for specific product SKUs causes the application to dump database table structures directly onto the results page. Which underlying vulnerability class is most likely responsible for this behavior?
⚠ Common exam trap
Candidates often confuse 'SQL Injection' with 'Information Disclosure'. While the result is information disclosure, the vulnerability class responsible for the dump is specifically SQL injection via unescaped input.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Error-based SQL injection via unescaped search input processed directly by the database engine
Error-based SQL injection occurs when database error messages are displayed directly to the end user through the web interface. Attackers leverage these verbose debugging messages to extract database schemas, table names, and sensitive column contents piece by piece. Remediating this requires implementing custom error handling and parameterized queries globally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-Site Scripting via injected JavaScript payloads in the SKU search field
Why it's wrong here
Cross-Site Scripting executes malicious scripts in the victim browser rather than interacting directly with database execution logic. While dangerous, XSS does not natively dump internal database table structures or reveal underlying schema definitions directly onto application response pages.
- ✓
Error-based SQL injection via unescaped search input processed directly by the database engine
Why this is correct
Unsanitized user inputs concatenated directly into SQL query strings allow attackers to manipulate execution flow and trigger database errors. Verbose database exceptions outputted to the user interface reveal structural details, making error-based SQL injection the primary suspect for this specific application behavior.
- ✗
Remote Code Execution via insecure deserialization of serialized PHP objects
Why it's wrong here
Insecure deserialization exploits flaws in how application objects are reconstructed from serialized data strings. This vulnerability typically yields arbitrary code execution or system command access rather than structured database schema information exposed directly in standard search results.
- ✗
XML External Entity injection via malformed search queries processed by an XML parser
Why it's wrong here
XML External Entity vulnerabilities occur when parsers process malicious external entity definitions within uploaded or submitted XML documents. This leads to local file disclosure or server-side request forgery rather than direct relational database schema error exposure.
About these practice questions
Courseiva writes every GCIH question from scratch — 322 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.