PhpDig version 1.6.x allows for remote command execution in its config.php script. Anybody can inject a url in the relative_script_path variable and obtain command execution with web server privileges.
b24e855c02a2ea8f3937595116627162c9ebfb2051a870e2bd9c0282161bf0f6