Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    public function saveXHRFile($destination, $orig_name=''){

        $target = @fopen($destination, 'wb');
        $input  = @fopen("php://input", 'rb');

        if (!$target){
            return array(
                'success' => false,
                'error'   => LANG_UPLOAD_ERR_CANT_WRITE,
                'name'    => $orig_name,
                'path'    => ''
            );
        }
        if (!$input){
            return array(
                'success' => false,
                'error'   => LANG_UPLOAD_ERR_NO_FILE,
                'name'    => $orig_name,
                'path'    => ''
            );
        }

        while ($buff = fread($input, 4096)) {
            fwrite($target, $buff);
        }

        @fclose($target);
        @fclose($input);

        $real_size = filesize($destination);

        if (!$real_size || $real_size != $this->getXHRFileSize()){
            @unlink($destination);
            return array(
                'success' => false,
                'error'   => LANG_UPLOAD_ERR_PARTIAL,
                'name'    => $orig_name,
                'path'    => ''
            );
        }

        if($this->allowed_mime !== false){
            if(!$this->isMimeTypeAllowed($destination)){
                @unlink($destination);
                return array(
                    'error'   => LANG_UPLOAD_ERR_MIME.'. '.sprintf(LANG_PARSER_FILE_EXTS_FIELD_HINT, implode(', ', $this->allowed_mime_ext)),
                    'success' => false,
                    'name'    => $orig_name,
                    'path'    => ''
                );
            }
        }

        return array(
            'success' => true,
            'path'    => $destination,
            'url'     => str_replace($this->site_cfg->upload_path, '', $destination),
            'name'    => $orig_name,
            'size'    => $real_size
        );

    }