To which (STRIDE/CIA+AAA) security category do command injection attack belong?
Or is my question too simplistic? Does it depend on the specifics of the injection attack (trying to get at confidential information, trying to cause a denial of service), or should it be thought of as tampering (compromise integrity of user input) or elevation of privilege (having some program (the web server) perform an action with their privileges on your behalf)?
Command injection attacks don't fit nicely in the STRIDE framework or in the CIA/AAA paradigm, and there's a reason for that.
The CIA/AAA paradigm provides a set of goals of information security, and it's not meant to characterize attacks.
As for the STRIDE model, it provides a classification of threats for threat modeling purposes. However, that is just the beginning of threat modeling.
In fact, threat modeling often uses threat graphs, or other representations, to identify all the possible threats to a system starting from the broad STRIDE category.
Example. For the Information disclosure category, what kind of information can an attacker disclose? For each kind of information, what different cases should be distinguished? For each such case, what kind of attacks could be successful?
In this way, threat modeling is not tied to specific vulnerabilities and also allows to understand how many threats could a given patch fix. It's very useful.
So, the STRIDE model is just the beginning of threat modeling, which explains why specific attacks (like command injection) don't fit nicely into it. But, in the particular case of command injection attacks, there is another reason.
The point of command injection is that an attacker can send commands to a system. Therefore, a command injection attack could be used to do anything, from erasing logs (Tampering), to carry out a DDoS (Denial of service), to privilege escalation, to information disclosure (see SQLi,...), and much more. Basically, the whole STRIDE model, and the whole CIA/AAA paradigm.
One may argue that command injection is the most general attack ever, since it simply means that the attacker has the capability to send commands to a system. The purpose of these commands is the real threat.
