🎴 Flashcard Mode
Information Security and Web Vulnerabilities
Identify vulnerability for code below Class Execclass { public static void main (String args []) { Runtime rt = Runtime.getRuntime (); Process proc = rt.exec ("cmd.exe /C") ;} }
The Java code uses Runtime.exec() to execute 'cmd.exe /C' without proper input validation. If user input were concatenated into this command string, an attacker could inject arbitrary system commands after the /C flag. This is a classic Command Injection vulnerability where the application passes unsanitized data directly to a system shell. Buffer Overflow (A) would require memory corruption, CSRF (C) requires cross-site request forgery context, XSS (D) needs web page output rendering, and XST (E) relates to cross-site tracing.