Probably a directory of php files like,

   sections/food.php
   sections/shopping.php
   sections/fryclub.php

with different content, then an index page like,

   <!-- common header -->
   <?php include("sections/" . $_GET["section"] . ".php") ?>
   <!-- common footer -->

And then when you access,

   http://fry.com/index.php?section=fryclub

you get the content of fryclub.php with the correct headers and footers. Or you access,

   http://fry.com/index.php?section=/../.[snip]./../etc/passwd%00

and get any file you like, treated like a php file.

Find a file that you can write to (such as the error log), use the above trick to treat it as a php file, use it to make system calls, and the box is yours.

Thanks for that. I wasn't aware that this was a common practice. I assumed it must be something like that, but I wanted to make very sure I understood exactly. Don't want any hacker news stories about my sites!

EDIT: Errr, at least, not this sort of story.

You can actually search for this vulnerability on Google Code Search, and it finds a few results that look exploitable. I don't know how to go about informing people with that code that their systems are vulnerable. Many are open source projects, so anyone using those tools are vulnerable too.

It's a pretty common attack. I have several identical attempts against my website on a daily basis (can easily tell from the access logs).