An application's error page displays: 'Error in /var/www/app/models/user.rb:45:in authenticate: ActiveRecord::StatementInvalid (PG::SyntaxError: ERROR: unterminated quoted string)'. What OWASP risk does this create?
- A.The error message only confirms that the application uses PostgreSQL, which is public knowledge
- B.The error message is a Rails debugging feature and poses no risk in production
- C.The error message reveals the framework (Rails), ORM (ActiveRecord), file system path (/var/www/app/models/user.rb:45), database type (PostgreSQL), the specific vulnerable function (authenticate), and confirms that user input reached a SQL query unescaped - confirming SQL injection vulnerability and providing a roadmap for targeted exploitation. This is OWASP A05 (Security Misconfiguration) and A09 (Logging/Monitoring Failures)
- D.The error message reveals SQL injection only if the attacker can see the full stack trace
Why C is correct