The described scenario is aninjection attack. Injection occurs when unvalidated input—such as SQL commands, script code, or OS instructions—is sent to an application through API forms or parameters. If the application fails to sanitize input, the attacker’s code may be executed with full system privileges.

On-path attacks intercept communication, credential attacks target authentication, and denial-of-service floods services. None involve code execution via unvalidated input.

Injection is a top risk in OWASP API Security Top 10. Developers must implement input validation, parameterized queries, and least privilege principles to mitigate this risk. API gateways and WAFs provide additional layers of protection but cannot replace secure coding practices.