The vulnerability exists due to insufficient sanitization of user-supplied input passed via the 'filename' parameter to the 'savebackup.php' script. This can be exploited to include arbitrary files from remote hosts and execute arbitrary PHP code. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable script. The code in the test.txt file contains a passthru command which can be used to execute arbitrary commands on the vulnerable system.