It all comes down to the credentials that that PHP code is running with on the server.
apache2 process running that PHP code is running as
www-root, the damage that this script can do goes to the extent of what
www-root can access, which would typically mean all of the
To fully understand this question, one needs to understand how linux works, if the web server is running under linux, to fully understand the extent of the possible damage.
If it's running under Windows, it would be the same thing, only the damage would be to the extent of what the owner of the process is able to use the machine's resources for.
Things that typically PHP viruses do are:
- Use your server to send spam
- Use your server to brute force other servers
- Use your server's resources to join their own rig and mine crypto-currencies
Those are just a few. They can pretty much use your server to run any software.