Which vulnerabilities are included in Injection Flaws?

• A. SQL injection, LDAP injection, and XPath injection.
• B. DNS spoofing and ARP poisoning.
• C. Strong authentication and logging.
• D. Buffer overflow as the only example.

Answer: (A)

Injection flaws happen when untrusted input is treated as part of a command or query by an interpreter, allowing the attacker to alter the intended logic or execution. SQL injection, LDAP injection, and XPath injection are classic examples because they all involve taking input and embedding it into a query language (SQL, LDAP, or XPath) without proper validation or parameterization. This means that malicious input can modify the query’s structure and permissions, potentially exposing data or bypassing authentication.

The other options don’t describe injection flaws. DNS spoofing and ARP poisoning are network-layer attacks aimed at misleading or intercepting traffic rather than injecting code into a query or command. Strong authentication and logging are security controls and practices, not injection vulnerabilities. Buffer overflow is a memory safety issue where writing past allocated boundaries can crash or hijack a program, which is a different category from injecting untrusted input into a query.