and how would the "benign attacker" know the super user password that sudo will ask for? its not like this is a logged in ssh session.
> its not like this is a logged in ssh session
That's not correct -- whatever user is executing your CGI scripts is the "logged-in" user in bash, right?
Obviously that user should be quite locked down, and should not be allowed to run sudo at all, let alone without a password... but there are so many amateur server admins out there that I imagine there are quite a few servers where this is a serious problem (with or without sudo access enabled for the executing user).