Command Injection

Definition

Input is executed by the OS shell.

Root cause

Passing input to shell commands.

Affected components

• Components in the “Injection” class
• Application / API handlers
• Supporting libraries

Impact

Full server compromise.

Severity

Critical

Safe lab reproduction

DVWA Command Injection module

Detection methodology

Process monitoring, EDR, unusual child processes of web servers.

Evidence examples

• Lab reproduction notes: DVWA Command Injection module
• Request/response excerpts (redacted)
• Detection signal: Process monitoring, EDR, unusual child processes of web servers

Remediation

Avoid shell calls; use safe APIs with argument arrays.

Secure coding examples

Use subprocess with list args and shell=False.