CVE-2019-25647
PhreeBooks ERP 5.2.3 Remote Code Execution via Image Manager
- State
- Published
- Severity
- 8.7 High
- Published
- Mar 24, 2026
- Updated
- Jul 28, 2026
- Reserved
- Mar 24, 2026
Description
PhreeBooks ERP 5.2.3 contains a remote code execution vulnerability in the image manager that allows authenticated attackers to upload and execute arbitrary PHP files by bypassing file extension controls. Attackers can upload malicious PHP files through the image manager endpoint and execute them to establish reverse shell connections and execute system commands.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
PhreeBooks ERPPhreesoft |
|
References
- ExploitDB-46645exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: PhreeBooks ERP 5.2.3 Remote Code Execution via Image Managerthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.