An attacker sent commands through an iscc video

Full Certification Question

An attacker sent commands through an application's input and data fields. By doing this, the attacker was able to get the application to execute the code he sent as part of its normal processing. The attacker was able to use this technique to get the application to expose sensitive data that he should not have access to. What type of attack was used here?