Once this file has been installed, the attacker can enter arbitrary commands to execute using a URL such as:
(attack code)
http://server.example.com/upload_dir/malicious.php?cmd=ls%20-l
which runs the "ls -l" command - or any other type of command that the attacker wants to specify.