The login form passes user input directly to a shell command without any kind of escaping or validation. In the file /usr/share/www/check.lp: #!/usr/bin/env cgilua.cgi <% local pass = cgilua.POST.password local com1 = os.execute("echo '"..cgilua.POST.password.."' | (su -c /bin/true)") An attacker is able to perform command injection using the "password" parameter displayed on the login form. An example "password" to bypass this authentication would be: f' > /dev/null # It is also possible for an attacker to simply execute code directly on the server.