Which of the following is NOT considered an injection flaw?

• A. SQL Injection
• B. OS Command Injection
• C. LDAP Injection
• D. Buffer Overflow

Answer: (D)

Injection flaws happen when untrusted input is interpreted as part of a command or query by a program, turning data into executable instructions. SQL Injection occurs when input is used to build a database query, allowing unauthorized queries. OS Command Injection happens when input is used to construct a system command, enabling execution of arbitrary commands on the host. LDAP Injection is similar, manipulating LDAP queries with crafted input to alter the search or access controls.

Buffer Overflow is not an injection flaw. It’s a memory safety issue where input exceeds the allocated buffer and overwrites adjacent memory, which can lead to crashes or arbitrary code execution through memory corruption rather than injecting commands or queries into an interpreter. Thus, Buffer Overflow is not considered an injection flaw.