<?php system("/bin/ls -l");?>
The programmer thought they were just including the contents of a regular data file, but PHP parsed it and executed the code. Now, this code is executed any time people view messages.
Notice that XSS (CWE-79) is also possible in this situation.
edit-config.pl: This CGI script is used to modify settings in a configuration file.