🎴 Flashcard Mode
IT Security Fundamentals Quiz
Card1 / 20
Mastered0
Review0
QuestionClick to flip
Identify the weakness in the below JSP file:
1 ...
2 <input type=button name="back" value="Back" onClick="javascript:doBack()">
3
4 <%
5 if("Admin".equals(session.getAttribute("user-type")))
6 {
7 %>
8 <input type=button name="Delete Users" value="View Stock" onClick="javascript:doDelete()">
9 <%
10 }%>
11 </form>
12
13 <script>
14 function doBack()
15 {
16 history.go(-1);
17 }
18 function doDelete()
19 {
20 document.forms[0].action="/DeleteUsersAction";
21 document.forms[0].submit();
22 }
23 </script>
24 ...
AnswerClick to flip back
A
Broken Access Control
💡 Explanation:
The code checks the session for the 'Admin' role to decide whether to render the 'Delete Users' button. However, the action endpoint /DeleteUsersAction is triggered via client-side JavaScript without verifying permission on the server side, representing a broken access control vulnerability.