PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/ via clients/editclient.php.
View the template here CVE-2017-6090.yaml
References:
https://github.com/ARPSyndicate/cvemon