4

This can be both, but the main responsibility for such problems is design. Independent on design, if developer is not forced to create a code that is vulnerable to SQL injection, but still creates it, it is an implementation problem. It means, developer either does not understand the problem, or understand but doesn't want to create a code that is resistant ...


3

Injections like SQL injection, XSS, etc are possible due to the possible combination of code and data within the same string and because developers construct such strings using untrusted and insufficiently validated user input. The possibility to mix code and data inside the same string is deep in the design of SQL, HTML+Javascript, ... This is similar to ...


2

Given a competent software architect, I would say the biggest issue tends to be implementation, and more specifically individuals that lack knowledge and training about secure coding best practice. To qualify this short answer, I will contrast with design and show that design covers a broad space, some design is prescribed and defined by others, the rest, ...


2

It's not just the victim "back stack". There are various possibilities. For example, let's say the victim app has not yet been launched. An attacker can place their activity in the background. Then when a user taps the icon of the victim app to start it, the "back stack" that the attacker's activity is lurking in could then come to the foreground and be ...


Only top voted, non community-wiki answers of a minimum length are eligible