Which of the following BEST describes a SQL Injection attack?

A.
The attacker attempts to have the receiving server pass information to a back-end database from which it can compromise the stored information.

B.
The attacker attempts to have the receiving server run a payload using programming commonly found on web servers.

C.
The attacker overwhelms a system or application, causing it to crash and bring the server down to cause an outage.

D.
The attacker overwhelms a system or application, causing it to crash, and then redirects the memory address to read from a location holding the payload.

Explanation:
SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution
(e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application’s software, for example, when user input is
either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL
injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.
Incorrect Answers:
B: “using programming commonly found on web servers” describes a cross-site scripting or XML injection attack. It does not describe a SQL injection attack.
Therefore, this answer is incorrect.
C: Examples of an attack that “overwhelms a system or application, causing it to crash and bring the server down” are DDoS attack, Syn floods and other flooding
attacks. The description does not describe a SQL injection attack. Therefore, this answer is incorrect.
D: The description “overwhelms a system or application, causing it to crash, and then redirects the memory address to read from a location holding the payload” is
describing a buffer overflow attack, not an SQL injection attack. Therefore, this answer is incorrect.

http://en.wikipedia.org/wiki/SQL_injection