let's say if a hacker get access of your sql and file system(like he got your root password)
so he can:
1: call ./bitcoind send command in ssh to send your bitcoins to his address.
2: upload a php (for example,JSON-RPC), to control your bitcoind with same command in 1
3: decrypt your php encode, then get the algo of hash of your sql data, won't be too hard if he has skill to hack your server
4: or just leave some small scripts in your payment process code which allows him to receive bitcoins when you pay/receive bitcoins, he can also set many conditions for this "steal program" so you can't find out there is problem only after long time or huge damage.
5: many others, predictable and unpredictable...
there is no 100%(not even 99%) secure at this moment for hosting a bitcoin in/out project. once your system get cracked, your bitcoins are gone. but i know there is a new thing called "multi-sig transactions" coming out on bitcoin's application which can stop unauthorized payments be processed even your system has been cracked.