Which Two Options Are Code Injection Vulnerabilities?
Short answer
BD Cross-site scripting and SQL injection are the code injection vulnerabilities, while arbitrary command injection and XML external entity injection are distractors.
Question
Key Takeaways
The exam tests Cisco's specific “code injection” category rather than the broader injection list; the trap is choosing arbitrary command injection (E) because it sounds like executable code.
Code injection vulnerabilities occur when an application executes attacker-supplied statements; for this SCOR item, the two answers are cross-site scripting (B) and SQL injection (D). The page explains why command injection and XXE are tempting but not the requested pair.
Common mistake: The common error is selecting arbitrary command injection (E) from the OCG's general injection list, even though SCOR separates command injection from code injection.
Expert Analysis
Why the Answer Is Correct
Cross-site scripting (B) and SQL injection (D) are the two options that match Cisco's code-injection framing. XSS inserts attacker-controlled script into a trusted page, so the victim's browser executes it; SQL injection inserts SQL fragments into a query and changes what the backend database executes. In the SCOR discussion, XanALaOM00 captured the exam reality by advising learners to "Choose B and D" and noting no official XXE reference, while XBfoundX highlighted that "Command injection is not the same as code execution and code injection." These are both code-level injection paths, not mere session or credential theft.
Why the Other Options Are Wrong
XML external entity injection (A) is an XML parser injection that can leak files or trigger SSRF, but Cisco's SCOR code-injection examples do not make it the answer here; it is a different injection class. Session hijacking (C) steals or reuses an existing session token and does not insert executable code into an application. Arbitrary command injection (E) is the strongest distractor: it is an injection vulnerability in the broad OCG list, but the same SCOR guide distinguishes command injection from code execution and code injection, so it is not one of the two requested here. diverjim64's page-31 citation reflects the broader injection list, not Cisco's narrower "code injection" wording.
Community Comment Notes
Several learners split on this ambiguous item. XanALaOM00 strongly recommended B and D and complained that XXE lacked an official material reference; Redou2201 also picked B and D and linked an external code-injection guide. XBfoundX supplied the key rebuttal to E, quoting that command injection is distinct from code injection, while Pierre_Bouvier argued for A and D by treating XXE as a code-injection example. diverjim64's "D and E for sure (p. 31 OCG)" is understandable because the OCG page lists SQL, HTML, and command injection as injection vulnerabilities, but the question's "code injection" wording and page-33 distinction keep E out.
Official Reference
- https://owasp.org/www-community/attacks/Code_Injection
- https://owasp.org/www-community/attacks/SQL_Injection
- https://owasp.org/www-community/attacks/xss/
These links open the official vendor documentation in a new tab.
Exam Strategy
When Cisco asks for code injection, separate it from the broader injection list: XSS and SQLi are the code-injection pair. Do not let “command injection” pull you to E; SCOR treats it as a separate injection category.
Frequently Asked Questions
Why is arbitrary command injection not one of the code injection answers?
Is XML external entity injection a code injection vulnerability?
Discussion 10 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 10
-
XanALaOM00 👍 4On the Exam, Choose B and D, I don't see any reference to Answer A (External Entity Injection) in the official material, but I do for Answers B and D. /shrug, awful question
-
Pierre_Bouvier 👍 2Code injection vulnerabilities occur when an attacker is able to insert and execute malicious code into a program or query. Here’s how the correct examples fit: XML External Entity (XXE) Injection (A): This occurs when an application processes XML input containing a reference to an external entity. Attackers can exploit XXE vulnerabilities to extract sensitive data, perform denial of service (DoS), or execute remote requests. SQL Injection (D): In this attack, an attacker inserts malicious SQL statements into an input field to manipulate the database. SQL injection can lead to unauthorized access to sensitive data, database corruption, or even full system compromise.
-
diverjim64 👍 2D and E for sure (p. 31 OCG). "The following are examples of injection vulnerabilities..." a. SQL injection vulnerability b. HTML injection vulnerability c. Command injection vulnerability" Yes, "arbitrary" isn't part of the referenced quote, but it is close enough IMO.
-
Redou2201 👍 2I'm going with B and D based on this link : https://cycode.com/blog/code-injection-attack-guide/?nab=1#Types-of-Code-Injection-Attacks
-
Winux29 👍 2Agreed with XanALaOM00
Show 5 more comments
-
XBfoundX 👍 1A command injection is an attack in which an attacker tries to execute commands that he or she is not supposed to be able to execute on a system via a vulnerable application. Command injection attacks are possible when an application does not validate data supplied by the user (for example, data entered in web forms, cookies, HTTP headers, and other elements). The vulnerable system passes that data into a system shell. With command injection, an attacker tries to send operating system commands so that the application can execute them with the privileges of the vulnerable application. Command injection is not the same as code execution and code injection, which involve exploiting a buffer overflow or similar vulnerability.
-
942f31a 👍 1Here is a breakdown of why each option fits this category:a. SQL injection vulnerability: This occurs when an attacker inserts malicious SQL statements into entry fields (like a login form), allowing them to manipulate or access the backend database.b. HTML injection vulnerability: This happens when an application includes malicious HTML code provided by a user into its web pages without proper sanitization, which can deface pages or steal user data.c. Command injection vulnerability: This allows an attacker to execute arbitrary operating system (OS) commands on the host server via a vulnerable application interface.
-
XanALaOM00 👍 1Another bad question from Cisco. more elaboration is needed for the question. If the question read specifically "Two Examples of Server Side Injection" then A and D are 100% correct as Cross-Site is Client Side. awful question because the answer here very well could be B and D if you put your blinders on to anything outside of Cisco material. The type of questions that make me feel like this exam truly is meant to brainwash you instead of test your knowledge.
-
XBfoundX 👍 1This is the most crucial thing: Command injection is not the same as code execution and code injection, which involve exploiting a buffer overflow or similar vulnerability. This is taken by the official SCOR manual, page 33 Chapter 1 CyberSecurity Foundamentals
-
aa4a63c 👍 1Xss, SQL injections
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.