Security Testing Language
5 exercises — practise writing OWASP findings, classifying CVSS severity, distinguishing SAST/DAST/IAST, structuring pentest reports, and defining engagement scope.
0 / 5 completed
1 / 5
A security tester discovers that the login endpoint accepts a SQL injection payload that returns a valid session without valid credentials. Which finding description is the most appropriate for a security test report?
A professional security finding includes OWASP classification, exact location, reproducible evidence, CVSS score, and a concrete recommendation.
Options A, B, and D identify the issue but lack structure — they cannot be used to triage, prioritise, or reproduce the finding in isolation. Option C follows the industry-standard security finding format: OWASP category and ID (A03:2021), the exact vulnerable endpoint and parameter, the specific payload used with the observed response, the CVSS score for risk quantification, and a targeted remediation recommendation. This structure allows any developer or security engineer to locate, reproduce, and fix the issue from the report alone.
Key vocabulary:
• SQL Injection — insertion of malicious SQL code into a query via unsanitised user input
• OWASP A03:2021 — the Injection category in the OWASP Top 10 (2021 edition)
• CVSS Base Score — Common Vulnerability Scoring System; 0–10 scale for severity quantification
• Parameterised statement — a prepared SQL query where user input is passed as a parameter, not embedded
• Session token — a credential that grants authenticated access; must never be obtainable without valid login
Options A, B, and D identify the issue but lack structure — they cannot be used to triage, prioritise, or reproduce the finding in isolation. Option C follows the industry-standard security finding format: OWASP category and ID (A03:2021), the exact vulnerable endpoint and parameter, the specific payload used with the observed response, the CVSS score for risk quantification, and a targeted remediation recommendation. This structure allows any developer or security engineer to locate, reproduce, and fix the issue from the report alone.
Key vocabulary:
• SQL Injection — insertion of malicious SQL code into a query via unsanitised user input
• OWASP A03:2021 — the Injection category in the OWASP Top 10 (2021 edition)
• CVSS Base Score — Common Vulnerability Scoring System; 0–10 scale for severity quantification
• Parameterised statement — a prepared SQL query where user input is passed as a parameter, not embedded
• Session token — a credential that grants authenticated access; must never be obtainable without valid login