CVE-2019-25647

PhreeBooks ERP 5.2.3 contains a remote code execution vulnerability in the image manager that allows authenticated attackers to upload and execute arbitrary PHP files by bypassing file extension controls. Attackers can upload malicious PHP files through the image manager endpoint and execute them to establish reverse shell connections and execute system commands.

CVSS v4.0

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.80% chance of exploitation in the next 30 days, 54th percentile

Published

2026-03-24

Updated

2026-07-28

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/46645

References

• CVE Record
• NVD entry

Related

• CVE-2019-25646
• CVE-2019-25648
• CVE-2019-25645
• CVE-2019-25649
• CVE-2019-25644
• CVE-2019-25650