Study. uk . com
  1. Home
  2. All questions
  3. Question 471

CISSP study material · question 471 of 500

An application passes unsanitised user input into an object-relational mapper's search parameters. What does OWASP's 2025 injection entry say about this?

  1. It is a cryptographic failure, since the records are returned unencrypted.
  2. It is safe, because the mapper always parameterises the resulting query.
  3. It is an injection condition, because the unsanitised data can extract additional sensitive records.
  4. It is a broken access control issue rather than an injection issue.
Show the answer

Answer: C. It is an injection condition, because the unsanitised data can extract additional sensitive records.

OWASP lists unsanitised data used within object-relational mapping search parameters, allowing extraction of additional sensitive records, among the conditions that make an application vulnerable to injection.

Source: OWASP Top 10 A05:2025 (OWASP) — OWASP Top 10:2025 A05 Injection > Description

Challenge yourself on this topic → Study as cards