OS command injection

When it applies

A parameter is concatenated into a shell command the server runs (a ping diagnostic, an ImageMagick/ffmpeg convert, a tar/zip, a filename passed to a CLI). If the value reaches /bin/sh -c unsanitised, you can append your own command.

Why it works

Building a command string from input and handing it to a shell means shell metacharacters keep their meaning: ;, |, &&, $(), and backticks all start a new command in the same context (usually the web user). The app never intended a second command — the shell can't tell the difference.