Which of the following is a common security threat that targets web applications?

SQL injection is a code injection technique that targets data-driven web applications. An attacker inserts malicious SQL statements into an application's input fields (e.g., a login form or search bar). If the application does not properly sanitize this input, the malicious code is executed by the backend database. This can allow an attacker to bypass authentication, view, modify, or delete data, and potentially gain administrative control over the database server. It is a direct and prevalent attack against the application layer, exploiting vulnerabilities in the application's code.

B. DNS poisoning: This is a network infrastructure attack that corrupts DNS server data to redirect users to malicious sites, not a direct exploit of web application code.

C. Man-in-the-middle attack: This is a network-level attack that intercepts communication between two parties; it targets the communication channel, not a vulnerability within the web application itself.

D. Distributed Denial of Service (DDoS): This attack targets the availability of a service by overwhelming it with traffic, rather than exploiting a flaw in the application's logic or code.

1. OWASP Foundation. (2021). OWASP Top 10:2021. A03:2021-Injection. The document states, "An application is vulnerable to injection when... user-supplied data is not validated, filtered, or sanitized by the application." It explicitly lists SQL injection as a primary example of this common web application security risk.

2. Bates, R., & Jackson, C. (2014). Lecture 14: Web Security. MIT OpenCourseWare, 6.858 Computer Systems Security, Fall 2014. The lecture notes (specifically slides 29-38) detail SQL injection as a fundamental web security problem where "user input is used to construct a database query," demonstrating it as a direct attack on the web application's interaction with its database.

3. Cisco. (2018). Web Application Firewall (WAF) on the Cisco ASA 5500-X Series Configuration Guide. Chapter: Information About the Web Application Firewall, Section: SQL Injection Match. This official vendor documentation describes SQL injection as a "common attack against web servers" and details how Cisco's WAF product provides specific protection against it, confirming its status as a primary web application threat.