PCI DSS 6.5.7 identifies which vulnerability?

PCI DSS 6.5.7 identifies which vulnerability?

• A. Cross-site request forgery (CSRF)
• B. SQL injection
• C. Cross-site scripting (XSS)
• D. Directory traversal

Answer: (C)

This item focuses on how PCI DSS guides secure web application development by addressing vulnerabilities that arise from processing and displaying user-supplied data. The vulnerability described by this requirement is cross-site scripting (XSS). XSS happens when a web application includes untrusted input in a page without proper encoding or validation, so an attacker’s injected script runs in other users’ browsers. That script can steal session tokens, capture credentials, or manipulate page content. To prevent XSS, developers must validate and sanitize input, escape or encode output before it’s rendered, and employ safeguards like Content Security Policy to restrict what scripts can execute. While other vulnerabilities like SQL injection, CSRF, or directory traversal are important, this PCI DSS item specifically addresses preventing XSS by handling dynamic content and user data safely.

This item focuses on how PCI DSS guides secure web application development by addressing vulnerabilities that arise from processing and displaying user-supplied data. The vulnerability described by this requirement is cross-site scripting (XSS). XSS happens when a web application includes untrusted input in a page without proper encoding or validation, so an attacker’s injected script runs in other users’ browsers. That script can steal session tokens, capture credentials, or manipulate page content. To prevent XSS, developers must validate and sanitize input, escape or encode output before it’s rendered, and employ safeguards like Content Security Policy to restrict what scripts can execute. While other vulnerabilities like SQL injection, CSRF, or directory traversal are important, this PCI DSS item specifically addresses preventing XSS by handling dynamic content and user data safely.