Whenever you're ready, walk me through how you'd approach this.
What possible vulnerabilities are possible in a vulnerable web application which allows arbitrary file upload?
