diff -urN httpd-2.2.15-orig/modules/filters/mod_include.c httpd-2.2.15/modules/filters/mod_include.c
--- httpd-2.2.15-orig/modules/filters/mod_include.c	2010-02-28 03:35:18 +0900
+++ httpd-2.2.15/modules/filters/mod_include.c	2010-08-30 10:28:06 +0900
@@ -1756,6 +1756,96 @@
 }
 
 /*
+ * <!--#exec cgi="..." cgi="..." --> (hack to treat as #include virtual)
+ */
+static apr_status_t handle_exec(include_ctx_t *ctx, ap_filter_t *f,
+                                apr_bucket_brigade *bb)
+{
+    request_rec *r = f->r;
+
+    if (!ctx->argc) {
+        ap_log_rerror(APLOG_MARK,
+                      (ctx->flags & SSI_FLAG_PRINTING)
+                          ? APLOG_ERR : APLOG_WARNING,
+                      0, r, "missing argument for include element in %s",
+                      r->filename);
+    }
+
+    if (!(ctx->flags & SSI_FLAG_PRINTING)) {
+        return APR_SUCCESS;
+    }
+
+    if (!ctx->argc) {
+        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+        return APR_SUCCESS;
+    }
+
+    while (1) {
+        char *tag     = NULL;
+        char *tag_val = NULL;
+        request_rec *rr = NULL;
+        char *error_fmt = NULL;
+        char *parsed_string;
+
+        ap_ssi_get_tag_and_value(ctx, &tag, &tag_val, SSI_VALUE_DECODED);
+        if (!tag || !tag_val) {
+            break;
+        }
+
+        if (strcmp(tag, "cgi")) {
+            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "unknown parameter "
+                          "\"%s\" to tag exec in %s", tag, r->filename);
+            SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+            break;
+        }
+
+        parsed_string = ap_ssi_parse_string(ctx, tag_val, NULL, 0,
+                                            SSI_EXPAND_DROP_NAME);
+        rr = ap_sub_req_lookup_uri(parsed_string, r, f->next);
+
+        if (!error_fmt && rr->status != HTTP_OK) {
+            error_fmt = "unable to include \"%s\" in parsed file %s";
+        }
+
+        if (!error_fmt && (ctx->flags & SSI_FLAG_NO_EXEC) &&
+            rr->content_type && strncmp(rr->content_type, "text/", 5)) {
+
+            error_fmt = "unable to include potential exec \"%s\" in parsed "
+                        "file %s";
+        }
+
+        /* See the Kludge in includes_filter for why.
+         * Basically, it puts a bread crumb in here, then looks
+         * for the crumb later to see if its been here.
+         */
+        if (rr) {
+            ap_set_module_config(rr->request_config, &include_module, r);
+        }
+
+        if (!error_fmt && ap_run_sub_req(rr)) {
+            error_fmt = "unable to include \"%s\" in parsed file %s";
+        }
+
+        if (error_fmt) {
+            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, error_fmt, tag_val,
+                          r->filename);
+            SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+        }
+
+        /* Do *not* destroy the subrequest here; it may have allocated
+         * variables in this r->subprocess_env in the subrequest's
+         * r->pool, so that pool must survive as long as this request.
+         * Yes, this is a memory leak. */
+
+        if (error_fmt) {
+            break;
+        }
+    }
+
+    return APR_SUCCESS;
+}
+
+/*
  * <!--#echo [encoding="..."] var="..." [encoding="..."] var="..." ... -->
  */
 static apr_status_t handle_echo(include_ctx_t *ctx, ap_filter_t *f,
@@ -3863,6 +3953,18 @@
         ssi_pfn_register("include", handle_include);
         ssi_pfn_register("flastmod", handle_flastmod);
         ssi_pfn_register("printenv", handle_printenv);
+    }
+
+    return OK;
+}
+
+static int include_post_config_for_exec(apr_pool_t *p, apr_pool_t *plog,
+                                        apr_pool_t *ptemp, server_rec *s)
+{
+    ssi_pfn_register = APR_RETRIEVE_OPTIONAL_FN(ap_register_include_handler);
+
+    if(ssi_pfn_register) {
+        ssi_pfn_register("exec", handle_exec);
     }
 
     return OK;
@@ -3907,6 +4010,7 @@
     APR_REGISTER_OPTIONAL_FN(ap_ssi_parse_string);
     APR_REGISTER_OPTIONAL_FN(ap_register_include_handler);
     ap_hook_post_config(include_post_config, NULL, NULL, APR_HOOK_REALLY_FIRST);
+    ap_hook_post_config(include_post_config_for_exec, NULL, NULL, APR_HOOK_LAST);
     ap_hook_fixups(include_fixup, NULL, NULL, APR_HOOK_LAST);
     ap_register_output_filter("INCLUDES", includes_filter, includes_setup,
                               AP_FTYPE_RESOURCE);
