I have recently found out that a server I am working on has an xinetd service that is in fact a shell script that calls another shell script with arguments retrieved via respective network connections.
It does something like this:
/execute/another/script $WITH $A $FEW $ARGUMENTS
What makes me afraid this is a real problem is the fact that the variables are not sanitized in any way and since this is executed as root it's something to be taken seriously.
Could someone please advise? I would also be curious to find out how one can abuse variables in such situations in order to have something else executed, can someone provide examples?