CVE-2019-25630
Published: 24 March 2026
Summary
CVE-2019-25630 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Phreesoft Phreebookserp. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
PhreeBooks ERP version 5.2.3 suffers from an arbitrary file upload vulnerability in its Image Manager component. The flaw allows authenticated attackers to upload malicious files by submitting requests to the image upload endpoint at bizuno/image/manager via the imgFile parameter. Uploaded PHP files can then be executed through the bizunoFS.php script, enabling remote code execution. This issue is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation grants high-impact remote code execution, potentially allowing full server compromise, including data exfiltration, modification, or denial of service.
Advisories and references, including those from Vulncheck detailing the PhreeBooks ERP arbitrary file upload via Image Manager, highlight the issue but do not specify patches in the provided details. A proof-of-concept exploit is publicly available on Exploit-DB (exploit 46644), and the latest PhreeBooks files can be downloaded from SourceForge, with the vendor site at phreesoft.com.
A proof-of-concept exploit demonstrates practical exploitability, underscoring the risk for unpatched PhreeBooks ERP 5.2.3 deployments. The CVE was published on 2026-03-24 despite its 2019 designation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20000
Vulnerability details
PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component that allows authenticated attackers to upload malicious files by submitting requests to the image upload endpoint. Attackers can upload PHP files through the imgFile parameter to…
more
the bizuno/image/manager endpoint and execute them via the bizunoFS.php script for remote code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload vulnerability in a web-based ERP application's Image Manager enables exploitation of public-facing applications (T1190) and execution of uploaded PHP files as web shells (T1100) for remote code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of the imgFile parameter in the Image Manager upload endpoint to block unrestricted uploads of dangerous PHP files.
Remediates the specific arbitrary file upload flaw in PhreeBooks ERP 5.2.3 by identifying, patching, and testing the vulnerable Image Manager component.
Scans uploaded files and monitors for malicious code execution via bizunoFS.php to mitigate remote code execution from exploited uploads.