Unrated severityNVD Advisory· Published Mar 24, 2026· Updated Mar 26, 2026
PhreeBooks ERP 5.2.3 Arbitrary File Upload via Image Manager
CVE-2019-25630
Description
PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component that allows authenticated attackers to upload malicious files by submitting requests to the image upload endpoint. Attackers can upload PHP files through the imgFile parameter to the bizuno/image/manager endpoint and execute them via the bizunoFS.php script for remote code execution.
Affected products
2- Range: = 5.2.3
- Range: 5.2.3
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- www.exploit-db.com/exploits/46644mitreexploit
- www.vulncheck.com/advisories/phreebooks-erp-arbitrary-file-upload-via-image-managermitrethird-party-advisory
- sourceforge.net/projects/phreebooks/files/latest/downloadmitreproduct
- www.phreesoft.commitreproduct
News mentions
0No linked articles in our index yet.