Once a user is inside the server, conducting standard activities such as entering data into forms, there is another world of harms that are at least possible. Invaders can do huge amounts of damage just by pushing the capability of forms or other protocols that provide a fixed buffer. Fill up the buffer in a form or chat area, add some assembly-level commands to the space after the buffer, and you can sometimes command the machine. Once you overrun a fixed boundary, all bets are off. If you know what you're doing, you can get into the computer.
Crackers can often exploit CGI scripts by overflowing a buffer.
If they do gain access to the data channeled by the CGI script, they often end up with particularly sensitive proprietary information. Imagine a form that collects customer data, and shunts the data to an Oracle database using a relatively simple script. The invading cracker will watch gleefully as the script taps into the database, and then gains access to the Oracle server as well. The problem with CGI scripts, Zuhn said, is that they tend to be seen as a quick task to be run informally for the convenience of the programmer. Most people who write CGI aren't defensive enough about their programming style to cope with all of the different ways information is handled.