I discovered this little PHP script that allows you to enter GET requests manually from the browser address bar and execute commands. I played around with it and discovered that I could do all kinds of things as www-data, including view the entire directory structure, copy files user accounts, painstakingly write scripts and PHP files, upload scripts, PHP files and executable programs, and upload and compile C source code.
I played with it on a spare machine that is not reachable from the Internet but it got me thinking about what could happen if this code was injected into a webpage (similar has been done with open source software I've used in the past) and wondering about steps that can be taken to lock down a server to prevent it.
So, is there any way to prevent www-data from executing commands that would allow these actions on a server, in case it is ever accessed in this manner?