PT-2026-27364 · Unknown · Phreebookserp

Abdullah Çelebi · Publicado 2026-03-24 · Atualizado 2026-03-24 · CVE-2019-25630

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PhreeBooks ERP version 5.2.3

Description The software contains a flaw in the Image Manager component that allows authenticated attackers to upload malicious files. Attackers can submit requests to the image upload endpoint, specifically uploading PHP files through the imgFile parameter to the ''bizuno/image/manager'' endpoint. These uploaded files can then be executed via the ''bizunoFS.php'' script, leading to remote code execution.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Correção

Unrestricted File Upload

XSS

Enumeração de Fraquezas

CWE-434

CWE-79

Identificadores relacionados

CVE-2019-25630

Produtos afetados

Phreebookserp

Referências · 5

• 🔥 https://exploit-db.com/exploits/46644 · Exploit
• https://vulncheck.com/advisories/phreebooks-erp-arbitrary-file-upload-via-image-manager · Nota
• https://sourceforge.net/projects/phreebooks/files/latest/download · Nota
• https://phreesoft.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25630 · Nota de Segurança