The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier as used in (1) ampache (2) libphp-snoopy (3) mahara (4) mediamate (5) opendb (6) pixelpost and possibly other products allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.