[TigerC10]

Yeah, the problem is with the way they handled the input to the server, it allows for someone to feed fake data into the application that can terminate the serverside script early and then insert their own code - which could actually allow an attacker to elevate their account to an admin account (and we all know the reprecussions of that ). As if that weren't enough, the scripts don't verify identity all that well, so with a few well worded commands an attacker could pull down the private account information of anyone they choose.