You are an ethical hacker at SilverRock Security, engaged by BayState Credit Union in Boston,...

The correct answer is D. UNION SQL Injection because the key observation is that the application’s response shows data from another table merged into the same page results, meaning the injected payload successfully combined two result sets into a single output. In CEH-aligned SQL injection taxonomy, UNION-based SQL injection occurs when an attacker uses the SQL UNION (or UNION ALL) operator to append the results of a second SELECT query to the original query’s results. If the application prints query results to the page, UNION injection is especially powerful because it can directly exfiltrate database contents in-band through the normal web response.

The scenario describes input into a numeric parameter in the customer dashboard (commonly an id value in a query such as selecting loan details). By manipulating this parameter, the attacker causes the back-end query to return not only the intended loan record(s) but also employee information from a different table. That is the hallmark of UNION SQL injection: retrieving unrelated columns/rows by crafting a second SELECT that matches the original query’s column count and compatible data types, then unioning it with the legitimate query so both datasets render together. Attackers often enumerate the number of columns (e.g., with ORDER BY tests) and then identify which columns are reflected in the response to place sensitive data where it will be displayed.

Why the other options do not match: Error-based SQL injection relies on database error messages to leak information, rather than cleanly merging results into the page. Blind SQL injection yields no direct data in the response and instead infers information via boolean conditions or time delays. Second-order SQL injection happens when malicious input is stored first and executed later in a different context; the prompt describes immediate, in-response merging of data.

Therefore, the behavior most directly indicates UNION SQL injection.