Which of the following is NOT a typical injection type?

• A. SQL injection
• B. Code injection
• C. Command injection
• D. Buffer overflow injection

Answer: (D)

Injection vulnerabilities occur when untrusted input is treated as part of the code, query, or command that the program executes. The three well-known examples fit this pattern: SQL injection happens when input is embedded into a database query and alters its meaning; code injection occurs when input is evaluated as source code by the runtime, allowing attacker-provided code to run; command injection happens when input is used to form operating system commands that are executed by the shell or command processor.

Buffer overflow, on the other hand, is a memory safety issue. It occurs when data written into a fixed-size buffer exceeds its bounds, potentially corrupting adjacent memory and control flow. While exploit payloads for overflow can sometimes lead to arbitrary code execution, the vulnerability type is not about injecting a new instruction into an interpreter or command processor. It’s a memory corruption problem, not a typical injection vector. That’s why it doesn’t belong with the standard injection types.