Comment by lccarrasco

> You get 3 guesses on what happened and probably need just one.

They had no validation on file type and you could upload & access a script that executed commands server-side?