CVE-2019-25630
PhreeBooks ERP 5.2.3 Arbitrary File Upload via Image Manager
- State
- Published
- Severity
- 8.7 High
- Published
- Mar 24, 2026
- Updated
- Jul 28, 2026
- Reserved
- Mar 24, 2026
Description
PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component that allows authenticated attackers to upload malicious files by submitting requests to the image upload endpoint. Attackers can upload PHP files through the imgFile parameter to the bizuno/image/manager endpoint and execute them via the bizunoFS.php script for remote code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-434 Unrestricted upload of file with dangerous type
Affected Products
| Product | Versions |
|---|---|
PhreeBooks ERPPhreesoft |
|
References
- ExploitDB-46644exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: PhreeBooks ERP 5.2.3 Arbitrary File Upload via Image Managerthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.