Question

A security analyst is reviewing Apache access logs after an IDS alert fired on a public-facing web application. One entry reads: GET /products.php?id=1%27%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1 followed by an HTTP 200 response and an unusually large response size. Which conclusion is best supported by this log entry?

Accepted Answer

A successful SQL injection attack that retrieved credential data from the database

Answer

A cross-site scripting (XSS) attempt that executed script in the victim's browser

Answer

A directory traversal attempt to access files outside the web root

Answer

A brute-force login attempt against the application's authentication form