[iamjason89]

Since system() PHP function didn't directly work, do you think he would have been able to gain full access as he suggested?

[i336_]

It would probably have required a bit of thought, but PHP can access databases, (presumably) alter files, and the like; so while full UNIX shell access might not have been possible, practically speaking PHP could have done a lot of damage on its own.