An earlier comment said "Although the system() PHP function didn't directly work..." so it would probably have been phpinfo().
Authenticating something like this is an interesting question though. Maybe make the php script filename a sha256, then make the query string another sha256, and possibly add a few more sha256 query keys that have to match more sha256 strings. Or maybe that's overkill. (I keep wondering about cryptographic cipher-based solutions...)
As an aside, an attacker would have needed to know about the name `bugb.php`, which isn't an intuitive or easily guessable filename IMO, so there was a reasonable level of security-by-obscurity.
Authenticating something like this is an interesting question though. Maybe make the php script filename a sha256, then make the query string another sha256, and possibly add a few more sha256 query keys that have to match more sha256 strings. Or maybe that's overkill. (I keep wondering about cryptographic cipher-based solutions...)
As an aside, an attacker would have needed to know about the name `bugb.php`, which isn't an intuitive or easily guessable filename IMO, so there was a reasonable level of security-by-obscurity.