Command Injection in Nagios Fusion 4.1.8 and previous versions allows Privilege Escalation from apache to root in cmd_subsys.php.
nagios fusion