29.4 A03 Injection: Command Injection

By Ravindra Bagale Last updated: 27 September 2026

Command injection tevha hoto jevha app user cha input thet operating-system command madhe vaparto.

// vulnerable: pinging a host the user typed
$ip = $_GET['ip'];
system("ping -c 1 " . $ip);

If the attacker sends 8.8.8.8; cat /etc/passwd, the server runs both commands. Fixes: avoid calling the shell; if you must, use safe APIs and strict allow-lists, and escape with escapeshellarg().

$ip = $_GET['ip'];
if (filter_var($ip, FILTER_VALIDATE_IP)) {        // allow only a valid IP
    system("ping -c 1 " . escapeshellarg($ip));
}

Ravindra Bagale's Tip

Avoid OS commands if you can – for most tasks there is a library in PHP/Python (files, network). If you really need a command, use an allow-list (only valid IPs/names) and escapeshellarg(). User input directly into system() – never.

Ravindra Bagale's Tip – मराठी

शक्य असेल तर OS command टाळाच – बहुतेक कामांसाठी PHP/Python मध्ये library आहे (file, network). Command वापरणे गरजेचे असेल तर allow-list (फक्त valid IP/नाव) आणि escapeshellarg(). User input थेट system() मध्ये – कधीही नाही.

Ravindra Bagale's Tip – हिंदी

हो सके तो OS command से बचो – ज़्यादातर कामों के लिए PHP/Python में library है (file, network). Command इस्तेमाल करना ज़रूरी हो तो allow-list (सिर्फ़ valid IP/नाम) और escapeshellarg(). User input सीधे system() में – कभी नहीं.

Lab

In DVWA (Command Injection, low), append ; whoami to the IP field and see it run. On high, see it blocked. Write a safe version of the ping feature using FILTER_VALIDATE_IP and escapeshellarg().