Online Travel Agency System version 1.0 suffers from an arbitrary file upload vulnerability.