Adcycle is a banner management system which is written in Perl and uses MySQL for data storage.
Attackers can delete, change and add banner campaigns.
Another big problem is when build.cgi is called from a webbrowser, the AdCycle tables are dropped so all bannercampaigns are lost. The installation instructions say you should set the build. That will prevent some problems ofcourse, but is far from totally secure. When the owner of the scripts for example has the same gid as the httpd process, build.cgi is still executable for the evil outside world. I think everyone should remove all bits from build.cgi after a succesful install, or even completely remove it.