cgi-bin/webutil.pl in The Puppet Master WebUtil 2.3 allows remote malicious users to execute arbitrary commands via shell metacharacters in the whois command.
puppet master webutil 2.3