A county ticket system passes unsanitized user fields into a shell command that generates PDFs. Which vulnerability class does this describe?
Select an answer to reveal the explanation.
Short Explanation
Handing a stranger the microphone to the shell is a bad karaoke night for the server. When user text lands inside OS commands, that is command injection — often critical. Name the class and impact; skip payload shopping lists.
Full Explanation
OS command injection occurs when applications concatenate or otherwise insert untrusted input into system command execution. Impact commonly includes full host compromise under the service account. Safer designs use parameter APIs, avoid shells, and strictly validate inputs. IDOR, XSS, and open redirect may coexist elsewhere but do not define this PDF-generation pattern.