The xmlrpc interface of cobbler was prone to command injectoin