ws_mail.cgi in WebStore 400/400CS 4.14 allows remote authenticated WebStore administrators to execute arbitrary code via shell metacharacters in the kill parameter.
https://exchange.xforce.ibmcloud.com/vulnerabilities/6685
http://archives.neohapsis.com/archives/bugtraq/2001-06/0142.html