PhreeBooks ERP 5.2.3 Remote Code Execution via Image Manager
Description
PhreeBooks ERP 5.2.3 image manager allows authenticated users to upload arbitrary PHP files, bypassing extension checks, leading to remote code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
PhreeBooks ERP 5.2.3 image manager allows authenticated users to upload arbitrary PHP files, bypassing extension checks, leading to remote code execution.
Vulnerability
PhreeBooks ERP version 5.2.3 contains a remote code execution vulnerability in the image manager component. The image manager fails to properly validate file extensions, allowing authenticated attackers to upload arbitrary PHP files. This is a classic unrestricted file upload flaw (CWE-434). Affected versions are PhreeBooks ERP <= 5.2.3 [2][4].
Exploitation
An attacker must have a valid authentication session (low-privileged user credentials) to access the image manager endpoint. The attacker uploads a malicious PHP file (e.g., webshell) with a .php extension that bypasses the inadequate extension controls. Once uploaded, the attacker can access the file directly via the web server to achieve code execution [2][4]. The exploit is publicly available on Exploit-DB, providing a step-by-step Python script that uploads a PHP payload and triggers a reverse shell or system commands [2].
Impact
Successful exploitation allows the attacker to execute arbitrary PHP code on the underlying server, establishing a reverse shell and executing arbitrary system commands. This leads to full compromise of confidentiality, integrity, and availability of the ERP system and potentially the host operating system, depending on web server privileges [2][4]. The CVSS v4 score is 9.0 (Critical) [4].
Mitigation
No official patch has been released by PhreeSoft, as the company announced closure effective May 31, 2026 [3]. Users are advised to migrate to the stand-alone Bizuno fork on GitHub (bizuno.com) or discontinue use of PhreeBooks ERP [3]. As of the publication date (2026-03-24), no workaround has been provided by the vendor. The vulnerability is not listed in CISA KEV as of this writing.
AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- Range: =5.2.3
- Range: 5.2.3
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Insufficient file extension validation in the image manager allows upload of arbitrary PHP files."
Attack vector
An authenticated attacker uploads a malicious PHP file through the image manager endpoint. The application's file extension controls are bypassed, so the PHP file is accepted and stored on the server. The attacker then accesses the uploaded file directly via its URL, causing the PHP code to execute on the server. This enables arbitrary command execution, including establishing a reverse shell connection [ref_id=1].
Affected code
The vulnerability resides in the image manager endpoint of PhreeBooks ERP 5.2.3. The advisory does not specify exact file paths or function names, but the image manager upload functionality fails to properly validate file extensions, allowing PHP files to be uploaded.
What the fix does
No patch is included in the bundle. The advisory does not provide specific remediation guidance. To close the vulnerability, the image manager should validate uploaded files by checking both the file extension (allowing only image types such as .jpg, .png, .gif) and the file content (MIME type verification), and should store uploaded files outside the web root or serve them with a non-executable Content-Type header.
Preconditions
- authAttacker must have a valid authenticated session in PhreeBooks ERP 5.2.3
- networkThe image manager upload endpoint must be accessible over the network
- inputAttacker must supply a PHP file as the upload payload
Reproduction
The public PoC at https://www.exploit-db.com/exploits/46645 provides reproduction steps. An authenticated attacker uploads a PHP web shell via the image manager, then accesses the uploaded file's URL to trigger remote code execution.
Generated on May 24, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- www.exploit-db.com/exploits/46645mitreexploit
- www.vulncheck.com/advisories/phreebooks-erp-remote-code-execution-via-image-managermitrethird-party-advisory
- sourceforge.net/projects/phreebooks/mitreproduct
- www.phreesoft.commitreproduct
News mentions
0No linked articles in our index yet.