The ad.cgi script allows remote malicious users to execute arbitrary commands via shell metacharacters in the argument.
leif m. wright ad.cgi