CVE-2019-25630

HIGH

PhreeBooks ERP 5.2.3 Arbitrary File Upload via Image Manager

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-25630 has a selected CVSS score of 8.7 (high); EIP currently links 1 catalogued exploit.

Description

PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component that allows authenticated attackers to upload malicious files by submitting requests to the image upload endpoint. Attackers can upload PHP files through the imgFile parameter to the bizuno/image/manager endpoint and execute them via the bizunoFS.php script for remote code execution.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 24, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

PhreeBooks ERP

Browse Phreesoft / PhreeBooks ERP

Default status: unaffected

CVE List5.2.3affected

Proofs of concept

1

Catalogued exploits

ExploitDBPhreeBooks ERP 5.2.3 - Arbitrary File UploadExploitDB exploitby Abdullah ÇelebiNot analyzed1 file
ExploitDB
PoC details

References

5