book.cgi in NetCode NC Book 0.2b allows remote malicious users to execute arbitrary commands via shell metacharacters in the "current" parameter.
netcode nc book 0.2b