So, due to bad programming on the part of one of my former colleagues, one of our internal web apps allows the user to upload and run an arbitrary Python file. This recently came to light via an anonymous tip. So far I haven't done anything too crazy, just using the os library to browse the directory structure a little. I'm not sure how much damage I could do, though. There is a Python web app and a MySQL database running on the server.
Could I somehow give myself SSH access? I can't exactly figure out how I would go about that. I also don't think I can access the database, as I don't have any of the user information.
So, what is pretty well the practical limit of the worst damage I could do here?