Orangescrum is one of task management software written in PHP.
Its version 1.6.1 have multiple vulnerabilities. To exploit all of them, you have to log in first.
Create or reply task. Then upload a file. The file will be uploaded into directory app/webroot/files/case_files, without any validation.
Send a POST request to http://yourorangescrum/easycases/ajax_change_AssignTo  , with POST variables caseId and assignId.