inject malicious php file to the webroot folder

an attacker has inject an php file to the webroot folder where all the files and folders relating to many websites are reside. the php file can upload any file to current working directory of web root.

my question is how did he insert this php file to web root folder ??