Zennoxa Shield
Rules / C/C++
SHIELD-CPP-008

Command injection via system

criticalC/C++CWE-78CVSS 9.8

What it detects

system called with a variable or concatenated string can execute attacker-controlled commands.

How to fix

Avoid the shell; use execve with a fixed argument vector and validated inputs.

Vulnerable — Shield flags thisrun.c
#include <stdio.h>
#include <stdlib.h>

void ping_host(const char *host) {
    char cmd[128];
    snprintf(cmd, sizeof(cmd), "ping -c 1 %s", host);
    system(cmd);
}
Fixed — scans cleanrun.c
#include <unistd.h>

void ping_host(const char *host) {
    char *const argv[] = {"/bin/ping", "-c", "1", (char *)host, NULL};
    char *const envp[] = {NULL};
    execve("/bin/ping", argv, envp);
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CPP-008, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CPP-008: Command injection via system — Zennoxa Shield