It doesn't necessarily. But what it does do is pass information about the request in environment variables - that's step 1: attacker controls the contents of an environment variable. Then, if at any point the script invokes bash, or calls something like system(), exec() or popen() and has bash set as the default shell, then bash will run, with those environment variables set. That's step 2, and the server is now the attacker's.