Online Flight Booking System version 1.0 suffers from an arbitrary file upload vulnerability.