Command-injection is a type of attack where the main goal is to have system commands be executed by the host operating system of a vulnerable application. These types of attacks are possible when unsafe user input is passed from the application to a system shell. The commands that are supplied are executed at the privilege level of the application, for example, a web server may be run with a www-data user or Apache user as opposed to the root user.
Directory-traversal is when a server allow an attacker to read a file or directories outside of the normal web server directory.
File-inclusion vulnerabilities are vulnerabilities that allows an attacker to include a file to a web server by exploiting vulnerable inclusion procedures. This type of vulnerability occurs, for instance, when a page receives as input the path to the...