This seems to be some sort of PHP upload/download tool, together with its own custom protocol and custom client.

But why? If you have server access, use it directly. There are plenty of programs which can sync over SCP/SFTP/FTP etc.. directly, no need for some weird PHP shell and custom protocol and 2nd password...