A03 - Injection Greenbelt session 2025

Which of the following is the primary reason injection vulnerabilities occur?

• Improper authentication

• Unvalidated redirects

• Unsanitized user input used in commands or queries

• Missing session expiration

Which types of injection attacks are included under OWASP A03:2021 ? (Multiple correct answers)

• SQL Injection

• Command Injection

• Cross-Site Request Forgery

• LDAP Injection

What is a common impact of a successful SQL injection attack?

• Slower page loading

• Denial of Service

• Broken access control

• Unauthorized access to database contents

Which of the following is the BEST way to prevent injection attacks?

• Parameterized queries (prepared statements)

• Disabling copy-paste

• Input validation with blocklists

• Using CAPTCHA

Which languages or technologies are vulnerable to injection attacks? (Multiple correct answers)

• Java

• PHP

• Python

• None, if using modern frameworks only

What is the main reason input sanitization alone is not a foolproof defense against injection ?

• It’s only applicable to POST requests

• Sanitizers can be bypassed or misused

• It converts all input to lowercase

• It encrypts user data

An application allows users to enter their usernames to retrieve profile data but directly inserts that input into a SQL query. What is the vulnerability?

• Insecure deserialization

• SQL Injection

• Broken authentication

• XML External Entity

Which defenses help mitigate injection vulnerabilities? (Multiple correct answers)

• Whitelisting input

• Using stored procedures with parameters

• Encoding output

• Disabling JavaScript

What are the impacts of SQL Injection vulnerability

• 
  Bypass authentication

• Data loss

• 
  Unauthorized data access

• All of the above