I don't know if this is a Drupal thing or not, BUT I can tell you why under PHP exec would not be allowed.
Many shared hosts run PHP in safe mode. This is done primarily to prevent one account using the OS facilities available on the running server, being used to gather information from other accounts on the same server.
Anything that can be used to run external commands (Particularly OS commands that may run with root privileges) or view files in someone else's folder, is generally disabled.
On a shared hosting server, the web-server (Usually something like Apache) is often run using the same user (often something like www-data).
Beacuse this user is for all intents owned by the web server, then ANYTHING the web server has access to is technically readable by any account running PHP scripts in the web-servers context.
Safe mode PHP was designed to prevent this scenario occurring by allowing system admins to list in their PHP configuration, the names of methods and functions they deem to be unsafe on that particular server configuration.
There's a general school of thought, that ANY PHP function that allows external software to be run and controlled from a PHP script, should always be on the list. After that, directory functions and file functions are often added next.
There is also something called a "Safe mode folder", which means that some commands that are considered dangerous can be enabled, but can be restricted so they ONLY operate in the folder your scripts live in.
The final part of the puzzle, is the location of runnable external programs. Many web server hosts are configured to ONLY allow programs to be run from a certain folder. I'd be very sure that a tool like "shp2pgsql" would not be installed by default in any of these normal program execution folders.
This would lead me to believe that you've likely uploaded the program yourself, into your own server home folder, and by that it's very likely that even if you could enable the exec function, the chances of running your program outside the normal OS folders is still going to fail anyway.
Given that your running "shp2pgsql", my guess is that your trying to insert shape files into a postgres spatial database.
If I'm correct about this, then a better way to do it might be to convert the shape files to a more web friendly format such as geoJSON, then use a simple PHP script that talks directly to the database to upload those files into tables for further processing.
Current versions of Postgres have top class features for handling JSON data, and postgis can use SQL statements such as 'ST_GeomFromGeoJSON'
GeomFromGeoJson can take a GeoJson file, which you could easily read from your server using php's "get_file_contents" or "file" functions, and insert it directly into your spatial data table.
Beacuse GeoJSON is a text file, you can convert them on your workstation from Shp to GeoJson (GDAL should be able to help you here) , then just FTP them to your server and run your script.
If you must use "shp2pgsql" to do the task, then the only way your likely to get it working is to contact the company managing the web host for you, and ask if there is any way they can enable it for you.
On a final note, if your running on a dedicated server, IE: one that your paying to have exclusive access too, and no one shares with you, then it's highly likely that you'll be able to change the configuration for things like "safe mode PHP" yourself.