Giovanni Buzzin

The issue allows remote attackers to create arbitrary files and execute arbitrary code. This is achieved by using the savefile action with a file parameter containing a filename that has an executable extension in the body.asp file.

A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the `id` parameter in the "body.asp" file.