Command-injection vulnerabilities allow an attacker to inject commands into poorly-validated user input. This input is used in used in some form by the system shell and in the process, the command injected gets executed on the system.
One case where you may find this is an application that takes user input, for example a username or email address, and creates a folder on the system that's used to house that user's data, file uploads, and so on.
In our target system, DVWA, there is a page that is used to demonstrate this flaw by exploiting user input that is passed to the system ping command. Let's log in to DVWA again on the OWASP Broken Apps VM and select command injection from the menu on the left:
As stated before, this ...
