The q query parameter of http://example.com/vln.php is vulnerable to command injections, then the following command connects to it and starts a shell-like environment ...