Arbitrary file upload vulnerability in Zhiyuan OA allows attackers to upload and execute malicious files.