The target web application server is running as the root user and is vulnerable to command injection. Which result of a successful attack is true?

Cross-site scripting (XSS) is a client-side vulnerability where malicious scripts are injected into web pages and executed in the user's browser, which is different from a server-side command injection outcome.

A successful command injection attack on a web server running as the root user grants the attacker the ability to execute arbitrary operating system commands with the highest privileges. With this level of control, the attacker can modify the web application's files, including injecting malicious code that can then be used to perform cross-site scripting request forgery (CSRF) attacks against other legitimate users who visit the compromised application. This allows the attacker to trick authenticated users into executing unintended actions on the web application by leveraging the server compromise to inject CSRF payloads or alter security configurations.

While gaining root access through command injection implies privilege escalation from the web application's context, "privilege escalation" describes the method of gaining control, not a distinct client-side attack like CSRF that can be enabled by such a compromise on the web application itself.

Buffer overflow is a memory corruption vulnerability resulting from writing more data to a buffer than it can hold, which is a different class of vulnerability than command injection.