Identify vulnerability for code below Class Execclass { public static void main (String args []) { Runtime rt = Runtime.getRuntime (); Process proc = rt.exec ("cmd.exe /C") ;} }
-
Buffer Overflow
-
Command Injection
-
CSRF
-
XSS
-
XST
The Java code uses Runtime.exec() to execute 'cmd.exe /C' without proper input validation. If user input were concatenated into this command string, an attacker could inject arbitrary system commands after the /C flag. This is a classic Command Injection vulnerability where the application passes unsanitized data directly to a system shell. Buffer Overflow (A) would require memory corruption, CSRF (C) requires cross-site request forgery context, XSS (D) needs web page output rendering, and XST (E) relates to cross-site tracing.
The code calls Runtime.exec() to invoke cmd.exe directly, handing control of the operating system's command interpreter to the application. If any part of the command string is built from user-supplied input (as is typical in the vulnerable pattern this question represents), an attacker can inject additional shell commands or metacharacters that get executed with the application's privileges — this is Command Injection. It is not Buffer Overflow (no fixed-size buffer being overrun), not CSRF (that's a web session/token-forgery issue on a browser-server trust relationship), not XSS (that involves injecting script into web pages viewed by other users), and not XST (Cross-Site Tracing, an HTTP TRACE-method attack) — none of those match executing an OS shell from within Java code.