The search.cgi script included with the AHG Search Engine does not adequately filter input. Due to lack of sufficient input sanitization, it is possible for a remote user to pass semi-colon ( and pipe (|) characters through a search request. This can result in the commands encapsulated between the symbols being executed with the privileges of the web server.