Sourcecodester Best Courier Management System 1.0 is vulnerable to Arbitrary file upload in the update_user function.