Actually it's worse than that - it allows them to execute any shell commands they want.