Language: PHP
Label: vulnerable
CWE: CWE-922 \u2014 Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Code:
function _saveSalariesFile( $id )
{
	global $error,
		$FileUploadsPath;

	$input = $id === 'new' ? 'FILE_ATTACHED' : 'FILE_ATTACHED_' . $id;

	if ( ! isset( $_FILES[ $input ] ) )
	{
		return '';
	}

	$file_name_no_ext = no_accents( mb_substr(
		$_FILES[ $input ]['name'],
		0,
		mb_strrpos( $_FILES[ $input ]['name'], '.' )
	) );

	$file_name_no_ext .= '_' . date( 'Y-m-d_His' );

	$file_attached = FileUpload(
		$input,
		$FileUploadsPath . UserSyear() . '/staff_' . UserStaffID() . '/',
		FileExtensionWhiteList(),
		0,
		$error,
		'',
		$file_name_no_ext
	);

	// Fix SQL error when quote in uploaded file name.
	return DBEscapeString( $file_attached );
}