Holy shit! Look at this! This is hilarious! https://github.com/bratliff/engconf/blob/0b8f003edc5f5d25fe1...

And it has been already exploited: http://wordpress.org/support/topic/plugin-ezpz-one-click-bac...

Oh. And it's for wordpress. Isn't that just fucking wonderful. I would guess looking at the age of the account and the complete lack of documentation that it's a personal project he never really intended to get much scrutiny. I'm sure if someone looked at my github they could find some bad code too. Not that bad though.

Edit - made an issue.

CGI Python? Happens... https://github.com/search?q=extension%3Apy+os.system+%22impo...

Django... https://github.com/search?q=extension%3Apy+os.system+%22requ...

I only found one exploitable example browsing the first few pages, whereas the majority of the OP's results looked fairly exploitable.

The difference is that SQL injection will only happen when using raw queries.

System (as you mentioned) or EXEC injections, however, may get out of hand.