Comment by LiveOverflow

OP confirmed that it wasn't exploitable, because it was not even running PHP code.