Water Billing Management System version 1.0 suffers from a cross site request forgery that enables an arbitrary file upload.