A security analyst in an insurance

company is assigned to test a new web application that will be used by clients to help them choose and apply for an insurance plan. The analyst discovers that the application is developed in ASP scripting language and it uses MSSQL as a database backend.

The analyst locates the applications search form and introduces the following code in the search input field:

IMG SRC=vbscript:msgbox(-Vulnerable-);> originalAttribute=-SRC- originalPath=-vbscript:msgbox(-Vulnerable-);>-

When the analyst submits the for

m, the browser returns a pop-up window that says -Vulnerable-.

Which web applications vulnerability did the analyst discover?

A. Cross-site request forgery

B. Command injection

C. Cross-site scripting

D. SQL injection