Seems that he was able to execute the "uptime" terminal command via that URL, and the output was served as page content. Now imagine what other dangerous terminal commands he could run.