Which type of attack involves executing arbitrary commands on the operating system to escalate privileges?

'Apache log' is not an attack type; Apache logs are files that record web server activity.

Cross-site scripting (XSS) is a client-side attack that injects malicious scripts into web pages viewed by other users, impacting their browsers, not typically executing commands directly on the server's operating system for privilege escalation.

Command injection, also known as OS command injection, occurs when an attacker can inject and execute arbitrary operating system commands through an insecure application that directly passes user-supplied input to a system shell. If the vulnerable application runs with elevated privileges, the injected commands can inherit those privileges, enabling privilege escalation and full system compromise.

SQL injection targets a database by injecting malicious SQL code into input fields, aiming to manipulate or extract database information, not to execute arbitrary commands on the underlying operating system.