Of course, its still a massive security hole, and I wouldn't be surprised if most hosts deny it in their service agreements.

I'd be surprised if you could distinguish this tool from another CGI script in any legally binding way.

There's no escalation of privilege for me as the CGI uploader, because I can already write scripts that do what I need, albeit not interactively.

If you're referring to the insecurity of an unsecured CGI script, that insecurity already exists in many scripts, such as the early Matt Wright attempts.

So, I don't get this "massive security hole" you speak of.

-- Randal L. Schwartz, Perl hacker
Be sure to read my standard disclaimer if this is a reply.