Which vulnerability allows an attacker to execute code within the context of the vulnerable process, potentially gaining its privileges?

Which vulnerability allows an attacker to execute code within the context of the vulnerable process, potentially gaining its privileges?

• A. SQL injection
• B. Memory injection
• C. Cross-site scripting
• D. Privilege escalation

Answer: (B)

This question is about code execution within the target process’s own memory space and privileges. A memory injection vulnerability arises when an attacker corrupts memory to place and run their own instructions inside the vulnerable process, often by exploiting a memory safety flaw such as a buffer overflow. Once the attacker’s code is placed in memory and execution is redirected to it (for example, by overwriting a return address), the code runs with the same permissions as the process itself. That means the attacker effectively takes on the process’s identity and privileges, rather than merely manipulating data or the user’s browser. This is different from SQL injection, which lets an attacker alter database queries; cross-site scripting, which causes a victim’s browser to run malicious scripts; and privilege escalation, which focuses on increasing access rights after initial compromise rather than executing code within the original process context. Memory injection directly enables running attacker-supplied code inside the vulnerable process, making it the best fit for the scenario.

This question is about code execution within the target process’s own memory space and privileges. A memory injection vulnerability arises when an attacker corrupts memory to place and run their own instructions inside the vulnerable process, often by exploiting a memory safety flaw such as a buffer overflow. Once the attacker’s code is placed in memory and execution is redirected to it (for example, by overwriting a return address), the code runs with the same permissions as the process itself. That means the attacker effectively takes on the process’s identity and privileges, rather than merely manipulating data or the user’s browser.

This is different from SQL injection, which lets an attacker alter database queries; cross-site scripting, which causes a victim’s browser to run malicious scripts; and privilege escalation, which focuses on increasing access rights after initial compromise rather than executing code within the original process context. Memory injection directly enables running attacker-supplied code inside the vulnerable process, making it the best fit for the scenario.