Request scope attack?

That's a unhelpfully broad question.

The answer is "yes", although they'd need to be quick to change something in the request scope.

It depends on what sort of hacking vector one is using as to what they can do on a server.

But if they get access to the file system, they can pretty much do whatever they like.

--

Adam