CVE-2019-25630 - Vulnerability Analysis

Overview

PhreeBooks ERP 5.2.3 contains an unrestricted file upload vulnerability caused by improper validation in the Image Manager component, letting authenticated attackers upload and execute malicious PHP files remotely, exploit requires authentication.

Severity & Score

Impact

Authenticated attackers can upload and execute malicious PHP files, leading to remote code execution and full system compromise.

Mitigation

Update to the latest version with the vulnerability fixed.

References

• https://sourceforge.net/projects/phreebooks/files/latest/download
• https://www.exploit-db.com/exploits/46644
• https://www.phreesoft.com/
• https://www.vulncheck.com/advisories/phreebooks-erp-arbitrary-file-upload-via-image-manager

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner