CVE-2019-25630

PhreeBooks ERP version 5.2.3 suffers from an arbitrary file upload vulnerability in its Image Manager component. The flaw allows authenticated attackers to upload malicious files by submitting requests to the image upload endpoint at bizuno/image/manager via the imgFile parameter. Uploaded PHP files can then be executed through the bizunoFS.php script, enabling remote code execution. This issue is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Authenticated attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation grants high-impact remote code execution, potentially allowing full server compromise, including data exfiltration, modification, or denial of service.

Advisories and references, including those from Vulncheck detailing the PhreeBooks ERP arbitrary file upload via Image Manager, highlight the issue but do not specify patches in the provided details. A proof-of-concept exploit is publicly available on Exploit-DB (exploit 46644), and the latest PhreeBooks files can be downloaded from SourceForge, with the vendor site at phreesoft.com.

A proof-of-concept exploit demonstrates practical exploitability, underscoring the risk for unpatched PhreeBooks ERP 5.2.3 deployments. The CVE was published on 2026-03-24 despite its 2019 designation.