An attacker has been successfully modifying the purchase price of items purchased on the company's web site. The security administrators verify the web server and Oracle database have not been compromised directly. They have also verified the IDS logs and found no attacks that could have caused this. What is the mostly likely way the attacker has been able to modify the purchase price? Select one: a. By using SQL Injection b. By using remote file inclusion c. By changing hidden values d. By using directory traversal attack

An attacker has been successfully modifying the purchase price of items purchased on the company's web site. The security administrators verify the web server and Oracle database have not been compromised directly. They have also verified the IDS logs and found no attacks that could have caused this. What is the mostly likely way the attacker has been able to modify the purchase price? Select one: a. By using SQL Injection b. By using remote file inclusion c. By changing hidden values d. By using directory traversal attack

Database System Concepts

7th Edition

ISBN:9780078022159

Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Publisher:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Chapter1: Introduction

Section: Chapter Questions

Problem 1PE

See similar textbooks

Similar questions

USING Microsoft studio SQL serve make a script that creates a user-defined role name FisionMike with the password 'NSV3p!4' that has the default database as FisionDB_v3 and has both Check Expiration and Check Policy turned off
Choose two of the following and for each describe how the attack function and how secure programming techniques can be used to protect against the attack SQLcode injection cross sit scripting XXS
If there is a database by the name StudentMarks in MongoDB then you can use use StudentMarks command to switch that database and start working on this database. But let’s assume that there is no database by the name StudentMarks in MongoDB. In this case if you still prefer use StudentMarks command than can be still OK and create the database and switch to it or would this command cause an error?Explain what happens in both scenarios?
To what extent do trustworthy web-based programs need to be protected? What could possibly go wrong with an unprotected program? Because of what must you guard against SQL injection attacks? It would be great if there was a website that explained this concept in more detail.
use oracle sql command line with found or notfound method --- with table Customer(customerNo,costomerName ,gender) Employee (employeeNo,employeeName,job) ,branch(No,Name), category(catNo,catogeryName) ___ 4) Create database package pointOfSal which contain the following A. procedure to add new customer which use validation method checkExistingCustomer using cursor to validate customer name if its not exists before, then add this new customer and generate the customer number automatically using database trigger. B. Method to add new Employee which use validation method checkExistingEmployee using cursor to validate Employee name if its not exists before, then add this Employee and generate the Employee number automatically using database trigger. C. procedure to add new Category which use validation method checkExistingCategory using exception to validate category name if its not exists before, then add this category and generate the category number automatically using database…
What is a SQL injection attack exactly? Describe how SQL injection attacks work and what must be done to prevent them.
In MongoDB, if documents in the collection had key names of fname, lname, age, email, and gender, in addition to the unique identifier, which values would be displayed in the output if the following command was entered: > db.collectionname.find({ "age" : { "$gt" : 18 }}, {fname: 1, lname:1, age:1}) A. fname, lname, age, email, gender, _id B. fname, lname and age C. fname, lname, age, email, gender D. fname, lname, age and _id
A malicious user sent many request to his company database and succeeded to know the sensitive percentage of employe that will be fired by end of the year because of austerity measure such type of disclosure is known as : 1)bound disclosure 2) existnve value disclosure 3)negative value disclosure 4)probable value disclosure
Based upon your readings this week, explain what each of the following terms mean and how they can be prevented. This will aid you in preparing for the quiz on this material. Topics: Buffer Overflow Injections (SQL, HTML, Command, Code) Authentication Credential brute force Session hijacking Redirect Default credentials Weak credentials Kerberos exploits Authorization Parameter pollution Insecure direct object reference Cross-site scripting (XSS) Stored/persistent Reflected DOM Cross-site request forgery (CSRF/XSRF) Clickjacking Security misconfiguration Directory traversal Cookie manipulationLinks to an external site. File inclusion Local Remote Unsecure code practices Comments in source code Lack of error handling Overly verbose error handling Hard-coded credentials Race conditions Unauthorized use of functions/unprotected APIs Hidden elements (sensitive info in the DOM) Lack of code signing
What is an SQL injection attack? Explain how it works and what precautions must be taken to prevent SQL injection attacks.
1. You have found a SQL injection vulnerability in a login function, and you try to use the input ‘ or 1=1-- to bypass the login. Your attack fails and the resulting error message indicates that the -- characters are being stripped by the application’s input filters. How could you circumvent this problem? please help me to solve this in correct. this answer was wrong that published which was (Well there is another possibility of using OR 1=1 after the query instead of using -- at the last since it has been filtered out by the application's input filters. Otherwise we can also use 1 =' 1. Thanks.) i ask my teacherso so I want correct answer for this Q so I want a clear answer…
Testing for SQL-injection vulnerability: Can SQL injection occur with forms of HTML input other than text boxes? If so, how would you test for vulnerability?