Shell Call Security Disaster

This is similar to an example distributed with the popular NCSA httpd server
- (At one time the most popular web server software)
It is a web gateway for the finger service
This one is in Perl; that one was a shell script

        #!/usr/bin/perl

        use CGI ':standard';

        print header, start_html('Finger Gateway');

        if (param()) {   # Form was submitted
          print "<PRE>\n";
          $cmd = 'finger ' . param('arg'); 
          print `$cmd`;
          print "</PRE>\n";
          exit 0;
        }

        print start_form, textfield('arg'), 
          submit, end_form;

        exit 0;