https://blog.semmle.com/ghostscript-CVE-2018-19475/
https://seclists.org/oss-sec/2016/q4/29

RCE through LFI using PHP sessions variables

https://www.zerodayinitiative.com/blog/2019/4/11/a-series-of-unfortunate-images-drupal-1-click-to-rce-exploit-chain-detailed
https://medium.com/@knownsec404team/the-analysis-of-drupal-1-click-to-rce-ad7799b428e6

EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;

The procedure to achieve it is as follows:

Declare a variable of “table” type to save the output that returns the xp_cmdshell procedure (remember that it returns the result in several rows).
Dump the output of the command to the previous variable.
Concatenate the rows of the table, separated by a line break.
Encode the resulting string in Base64 and save it in a variable.
Generate the certutil command, appending the string with the result.
Execute it.