Command Injection: Securing System Executions in Code

Command Injection occurs when an application executes OS commands (using shell helpers like `exec`, `system`, or `popen`) and concatenates unchecked user inputs into the command string.

1. How Command Injection Occurs

Consider a vulnerable ping diagnostic utility script:

$ip = $_GET['ip'];
system("ping -c 3 " . $ip);

If an attacker inputs `8.8.8.8; cat /etc/passwd`, the server executes:

ping -c 3 8.8.8.8; cat /etc/passwd

The semicolon splits the instructions, executing the system file print command directly.

2. Mitigation: Avoid Shell Execs

Avoid executing OS commands via code when native language APIs exist. If execution is mandatory, validate inputs against a strict alphanumeric whitelist, or pass inputs as array arguments to avoid shell parsing.