CVE-2013-4663: Improper Neutralization of Special Elements used in a Command

githttpcontroller.rb in the redminegithosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacharacters in 1 the service parameter to info/refs, related to the getinforefs function or 2 the reqfile argument to the fileexists function...