Anyone can execute any command on the remote system with the privileges of the web server. Anyone can read any file on the remote system which the webserver has access to.