What is command injection?
Command injection, sometimes called OS command injection, is a flaw where an application passes user input into a system shell and the attacker uses that to run commands of their own. It is dangerous because the commands execute with the privileges of the application, so a single unvalidated field can hand an attacker a foothold on the operating system itself rather than just the data.
How it happens
The vulnerable pattern is an application that builds a shell command by gluing in user input. A page that lets an administrator check connectivity might assemble a ping command from whatever host the user types. If that input is not controlled, the attacker appends their own instruction using a shell separator. The shell has no way to know which part was meant by the developer and which came from a stranger, so it runs all of it.
The metacharacters to recognize
The payloads are made of characters that are special to a command interpreter. A semicolon ends one command and begins another; && chains a second command when the first succeeds; a pipe sends one command's output into another; and backticks or $() run a command and substitute its result. In a log, a request that tries to read a system file, list a directory or reach back to the attacker's host with a download tool is the signal that someone is testing a parameter for this flaw.
How to defend against it
The strongest fix is to not call a shell at all: use a language's safe library function for the task, which never interprets metacharacters. When a program must run an external command, it should pass arguments as a controlled list rather than building one string, so input can never become a new command. Allow-list validation that accepts only an expected format, and running the process with the least privilege it needs, are layers on top, not the whole answer. The point is to keep user input out of the position where a shell would read it as code.
Command injection on the CompTIA Security+ exam
Command injection is one of the application-attack indicators under SY0-801 objective 2.5. The scenario clue is input containing shell characters such as a semicolon or pipe, followed by the server running a command the application never offered, often reading a sensitive file. Separate it from SQL injection, whose payload is query syntax aimed at a database, and from code injection in general. The exam-correct defense keeps data out of the shell: a safe API, argument lists, and strict input validation.