urp arbitrary file upload

vulnerable version: 1.38, 1.5
reference: <a href='http://www.wooyun.org/bugs/wooyun-2010-075251'>HackPanda, URP综合教务系统通杀第三弹(无需登录GETSHELL)</a>, 09/09/2014