I understand SQL injections they access as if normal db client. XSS attack can steal cookie data. But how do they hack a php app and get root? Apart from system

I understand SQL injections they access as if normal db client. XSS attack can steal cookie data. But how do they hack a php app and get root? Apart from system command running capable functions like eval how do they do