/path/to/nslookup cwe.mitre.org ; /bin/ls -l
As a result, the attacker executes the "/bin/ls -l" command and gets a list of all the files in the program's working directory. The input could be replaced with much more dangerous commands, such as installing a malicious program on the server.
The example below reads the name of a shell script to execute from the system properties. It is subject to the second variant of OS command injection.
(bad code)