CVE-2019-25630 | THREATINT

Description

PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component that allows authenticated attackers to upload malicious files by submitting requests to the image upload endpoint. Attackers can upload PHP files through the imgFile parameter to the bizuno/image/manager endpoint and execute them via the bizunoFS.php script for remote code execution.

PUBLISHED Reserved 2026-03-24 | Published 2026-03-24 | Updated 2026-03-26 | Assigner VulnCheck

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-434 Unrestricted upload of file with dangerous type

Product status

Default status

unaffected

5.2.3

affected

Credits

Abdullah Çelebi finder

References

www.exploit-db.com/exploits/46644 (ExploitDB-46644) exploit

www.phreesoft.com/ (Official Product Homepage) product

sourceforge.net/projects/phreebooks/files/latest/download (Product Reference) product

www.vulncheck.com/...arbitrary-file-upload-via-image-manager (VulnCheck Advisory: PhreeBooks ERP 5.2.3 Arbitrary File Upload via Image Manager) third-party-advisory

cve.org (CVE-2019-25630)

nvd.nist.gov (CVE-2019-25630)

Download JSON