Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 16 of 46).