Disclaimer: very unsafe script for any kind of use. Will overwrite any file that you give a path for. Be careful if you test it. Don't be uploading to a path of '/etc/passwd' if you're root :)

#!/usr/bin/perl -w
use strict;
use CGI ':standard';

# Print out the html page
sub print_html {
  my ($title, $msg) = @_;

  print header,
    start_html($title),
      start_multipart_form,
        p($msg),
        table(
          Tr( th( 'Upload Path:' ),
              td( textfield({ name    => 'upload_path',
                              default => './upload.txt' })
              )
          ),
          Tr( th( 'File to Upload:' ),
              td( filefield({ name => 'upload_field' }) )
          ),
          Tr( { colspan => 2 }, th( submit({ value => 'Upload File' })
+ ) )
        ),
      end_form,
    end_html;

  exit;
}


print_html(
  'Upload File',
  'Please select the file you wish to upload:'
) unless defined param('upload_field');


my $fh = upload('upload_field');

open UPLOAD, '>' . param('upload_path');
binmode UPLOAD;
print UPLOAD while <$fh>;
close UPLOAD;

print_html(
  'Upload Complete',
  "File $fh has been uploaded.<br />
   You can now upload another file if you wish:"
);
[download]