OWASP Top 10 Vocabulary | Security Lab Exercises

1 / 5

A security engineer says: "This endpoint is vulnerable to injection because user input is interpolated directly into the SQL query."

Which OWASP Top 10 category does this finding reflect?

Injection (A03 in OWASP Top 10 2021, formerly A01) occurs when untrusted data is sent to an interpreter as part of a command or query.

OWASP Category	Key signal	Classic example
Injection	Input interpolated into a query or command	SQL injection, command injection, LDAP injection
Broken Authentication	Weak session management, password handling	Credential stuffing, session fixation
Security Misconfiguration	Default credentials, debugging enabled in production	Debug endpoints exposed, S3 bucket public
IDOR	Direct reference to internal objects without authorisation check	`/api/invoice/1042` accessible by any user

Key vocabulary:

Interpolated directly — user input inserted into a string that becomes a SQL command without escaping or parameterisation
Untrusted input — data originating from user-controlled sources that cannot be trusted to be safe
Parameterised query (prepared statement) — the mitigation: bind user input as typed parameters, never as SQL text

2 / 5

An API review note reads: "The API returns data from the database by using the user-supplied customer ID directly, without checking that the requesting user owns that record."

Which vulnerability does this describe?

BOLA (Broken Object Level Authorisation), also known as IDOR (Insecure Direct Object Reference), is OWASP API Security Top 10 #1.

Term	Meaning
BOLA	Broken Object Level Authorisation — the OWASP API Security term
IDOR	Insecure Direct Object Reference — the classic OWASP Web Top 10 term for the same pattern
Horizontal privilege escalation	Attacker accesses another user's data at the same privilege level (not admin escalation)
Authorisation check missing	The server fetches the resource but does not verify `resource.ownerId === currentUser.id`

Root cause: The API trusts the client-supplied ID rather than scoping queries to the authenticated user. Fix: always add an ownership check before returning any resource.

Key vocabulary: "without verifying ownership", "horizontal privilege escalation", "authorisation check missing", "object-level access control".

3 / 5

A security reviewer writes: "The server returns a full stack trace including database schema details in 500 errors, and is running an unpatched version of nginx with debugging enabled in production."

Which OWASP Top 10 category covers this finding?

Security Misconfiguration (A05 in OWASP 2021) covers all of these signals: verbose error output, debugging enabled in production, and unpatched 3rd-party software.

Signal in finding	Security Misconfiguration sub-type
Full stack trace in 500 errors	Verbose error messages — information disclosure through misconfigured error handling
Database schema details exposed	Sensitive internal data leaked through error pages — aids attacker reconnaissance
Debugging enabled in production	Unnecessary features enabled — debug endpoints, verbose logging, test pages
Unpatched nginx version	Vulnerable Components — also covered by A06 "Vulnerable and Outdated Components"

Key vocabulary: "stack trace disclosure", "verbose errors in production", "debugging enabled", "unnecessary features", "default configuration", "unpatched components".

4 / 5

A new team member asks: "What exactly is the OWASP Top 10?"

Which answer is most accurate?

5 / 5

A bug report reads: "The vulnerability allows an attacker to inject malicious scripts into web pages viewed by other users."

Which vulnerability does this describe?

XSS (Cross-Site Scripting) = injecting malicious client-side scripts into pages viewed by other users.

Vulnerability	What is injected	Where it runs
XSS	Client-side scripts (JavaScript)	Victim's browser — steals cookies, redirects, keyloggers
SQL Injection	SQL commands	Database server — reads, modifies, or deletes data
CSRF	Forged HTTP requests	Victim's authenticated session — performs actions as the user
RCE	Arbitrary code / exploits	Server-side — attacker gains control of the server process

XSS types: Stored XSS (payload saved in database, served to all users); Reflected XSS (payload in URL, reflected back in response); DOM-based XSS (payload manipulates the DOM client-side).

Key vocabulary: "malicious scripts", "client-side injection", "script injection", "cookie theft", "session hijacking via XSS".