A security analyst reviews a penetration test report for a company's customer-facing web portal. The finding states: an attacker was able to submit crafted input into a search field that was passed unsanitized into a backend database query, allowing the attacker to retrieve records belonging to other users. Which OWASP Top Ten category best classifies this vulnerability?