SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script files) without the proper file format validation.