Multiple choice technology security

Identify the weakness in the below JSP file: 

1  ...   
2     
3    
4  <%   
5  if("Admin".equals(session.getAttribute("user-type")))   
6  {   
7  %>   
8     
9  <%  
10  }%>  
11    
12   
13    
14  function doBack()  
15  {  
16   history.go(-1);  
17  }  
18  function doDelete()  
19  {  
20   document.forms[0].action="/DeleteUsersAction";  
21   document.forms[0].submit();  
22  }  
23    
24  ...

  1. SQL Injection

  2. Cross Site Scripting

  3. Broken Access Control

  4. Improper Resource Initialization
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The code checks the session for the 'Admin' role to decide whether to render the 'Delete Users' button. However, the action endpoint /DeleteUsersAction is triggered via client-side JavaScript without verifying permission on the server side, representing a broken access control vulnerability.

Keep practicing — related questions