New scenario combines the two & is exploitable with msf module: exploit/multi/http/apache_mod_cgi_bash_env_exec