PT-2026-27381 · Phreesoft · Phreebookserp

Published 2026-03-24 · Updated 2026-03-24 · CVE-2019-25647

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

PhreeBooks ERP 5.2.3 contains a remote code execution vulnerability in the image manager that allows authenticated attackers to upload and execute arbitrary PHP files by bypassing file extension controls. Attackers can upload malicious PHP files through the image manager endpoint and execute them to establish reverse shell connections and execute system commands.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-25647

Affected Products

Phreebookserp

References · 5

• 🔥 https://exploit-db.com/exploits/46645 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25647 · Security Note
• https://phreesoft.com · Note
• https://sourceforge.net/projects/phreebooks · Note
• https://vulncheck.com/advisories/phreebooks-erp-remote-code-execution-via-image-manager · Note