You failed to convert your program's arguments into shell literals when you built your shell command. You're lucky someone didn't pass `rm -rf /` for $formValue! People need to think before inserting a string into another.

The simplest fix is to avoid the shell:

open(my $fh, '-|', '/usr/sbin/ubsetenv', $currParam, $formValue)
    or die("fork: $!\n");

local $/;
my $output = <$fh>;
[download]