A digital media company in Seattle, Washington deploys an Nginx-based infrastructure to support its internal...

The correct choice is OS command injection in nginxWebUI because the question describes untrusted input being passed into backend processing in a way that affects system-level operations. CEH web application material classifies command injection as an injection flaw that occurs when a vulnerable application allows attacker-controlled input to be interpreted by the operating system or shell environment. The key clue is that the tester manipulates parameters associated with uploaded content, and those altered values influence commands executed in the server-side web service context. That is the hallmark of command injection rather than SSRF, which would involve the server making unintended outbound requests, or certificate validation issues, which relate to TLS trust decisions. The mention of no direct shell access is also consistent with command injection, because the attacker does not need an interactive shell if malicious input can still alter system commands behind the application. CEH guidance repeatedly stresses that unvalidated input in web applications can lead to injection attacks, including command injection, when user-controlled values reach backend interpreters without strict sanitization, parameter control, or allow-list validation.