The software constructs all or part of an OS command using
					externally-influenced input from an upstream component, but it does not
					neutralize or incorrectly neutralizes special elements that could modify the
					intended OS command when it is sent to a downstream
					component.This could allow attackers to execute unexpected, dangerous commands
						directly on the operating system. This weakness can lead to a vulnerability
						in environments in which the attacker does not have direct access to the
						operating system, such as in web applications. Alternately, if the weakness
						occurs in a privileged program, it could allow the attacker to specify
						commands that normally would not be accessible, or to call alternate
						commands with privileges that the attacker does not have. The problem is
						exacerbated if the compromised process does not follow the principle of
						least privilege, because the attacker-controlled commands may run with
						special system privileges that increases the amount of damage.There are at least two subtypes of OS command injection:From a weakness standpoint, these variants represent distinct programmer
						errors. In the first variant, the programmer clearly intends that input from
						untrusted parties will be part of the arguments in the command to be
						executed. In the second variant, the programmer does not intend for the
						command to be accessible to any untrusted party, but the programmer probably
						has not accounted for alternate ways in which malicious attackers can
						provide input.