everybody can execute the smbpasswd if I understood you correct.
the cgi script can be run successfully, just after adding this part (which can be used in the shell), nothing happened to samba password, the script just skipped this part, so i m thinking maybe there is different way to write it...