Which of the following is a common web application vulnerability?

• A. Session management
• B. SQL injection
• C. Firewall misconfiguration
• D. Complex password requirements

Answer: (B)

SQL injection is a prevalent web application vulnerability that arises when an attacker is able to manipulate a web application's database by injecting malicious SQL code through input fields. This type of vulnerability typically occurs when user input is not properly validated or sanitized before being executed by the database. Attackers use this technique to gain unauthorized access to data, retrieve sensitive information, or even manipulate the database to their advantage, potentially compromising the integrity and confidentiality of the data stored.

In comparison, while session management can introduce vulnerabilities if handled poorly, it is not a specific type of attack like SQL injection. Firewall misconfiguration refers to issues in security apparatus and measures but isn't classified as a web application vulnerability itself. Complex password requirements are a form of security policy but do not represent an inherent vulnerability within a web application system. Therefore, SQL injection stands out as a distinctly recognized and common vulnerability in the landscape of web application security.