Menu Manager Mod for WebAPP - No Input Filtering

[web-app () hotmail com]

There is a system access vulnerability in the Menu Manager Mod for WebAPP. This mod is available at 
http://www.2xlnt.com/webapp/development/app.cgi?action=downloadinfo&cat=webappmods&id=3 .
 
System commands can be entered in user's personal menus. Any system command works there and allows reading of any 
private file or creating or deleting any file on server.
 
Example: Entering a string in the title of an item on a user's personal menu allows them to read the WebAPP script 
configuration file:
 
";system("cat $scriptdir/conf/config.dat");"
 
(entered WITH quotes)
 
This exploit does not work for servers that prevent system commands from being used.
 
The Menu Manager Mod was built in to core code of WebAPP in 2006, and the vulnerability also exists in the "WebAPP NE" 
script that is being distributed from web-app.net, in all known versions 0.9.9.3.3, 0.9.9.3.4, and upwards.
 
The current WebAPP core code Menu Manager system is now secured regarding this issue in WebAPP versions 0.9.9.7 and 
before, from the WebAPP site at http://www.web-app.org/cgi-bin/index.cgi .