On: Lycos is still around and its search is pretty goo...

[post_below]

CGI as in "Common Gateway Interface" or CGI.pm?

If the former, the injection vulnerability would be in the script talking to the server/database via CGI, rather than in CGI itself.

If the latter I don't remember any major unpatched vulnerabilities in CGI.pm, but it was epically inefficient.