An attacker has taken advantage of an application flaw on your company's public-facing web server that allows them to execute arbitrary code on the underlying operating system. This attack was made possible because the application did not properly sanitize user input, which was then used in a database query. What type of exploit has the attacker used?
SQL injection
Buffer overflow
Phishing attack
Cross-site scripting (XSS)