Update README.md

During my testing, as long the cgi has "#!/bin/bash" it is vulnerable to an attack, and you can change the http method and header to anything (i think), it would still work.