backticks and system are not the same (seeing as you want to capture the output backticks is proably what you want) but yes using system or backticks always opens up a potential security hole anytime it's used (not to say it can't be closed).

The main point is that a cgi script where a module is needed is confusing and harder to maintain - I just wanted to make sure you were aware of this. Though make sure the script is read-only as you are calling it with 'perl ...' and this will prevent it from being called through the webserver.