CVE-2021-47904

HighPublic PoC

Published: 23 January 2026

Published

23 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0046 64.5th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-47904 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Phreesoft (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 35.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly validates uploaded files in the Image Manager to block unrestricted uploads of dangerous types like PHP web shells by checking extensions, MIME types, and content.

SI-3 Malicious Code Protection good match

preventdetect

Deploys malicious code protection at upload entry points to scan and eradicate PHP web shells before they can be executed on the server.

SI-9 Information Input Restrictions good match

prevent

Restricts file uploads in the Image Manager to only permitted safe image types, preventing acceptance of executable PHP files.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

The vulnerability is an unrestricted file upload in a web application component (Image Manager), directly enabling exploitation of a public-facing application (T1190) to deploy and execute a PHP web shell (T1100) for remote code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution. Attackers can upload a malicious PHP web shell by exploiting unrestricted file type uploads to gain command execution on the server.

Deeper analysisAI

PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager, classified as CVE-2021-47904 and associated with CWE-434 (Unrestricted Upload of File with Dangerous Type). This flaw enables attackers to upload files without restrictions on type, specifically allowing the placement of a malicious PHP web shell on the server, which leads to remote code execution. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), highlighting its high severity due to network accessibility and significant impacts on confidentiality, integrity, and availability.

An attacker with low-privilege authenticated access (PR:L), such as a standard user account, can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants command execution on the server via the uploaded PHP web shell, potentially allowing full control over the affected PhreeBooks instance.

Advisories and related resources, including those from VulnCheck (https://www.vulncheck.com/advisories/phreebooks-remote-code-execution) and the vendor site (https://www.phreesoft.com/), provide further details on the issue. Public proof-of-concept exploits are available on Exploit-DB (https://www.exploit-db.com/exploits/46645 and https://www.exploit-db.com/exploits/49524), along with additional analysis at https://gist.github.com/joswr1ght/22f40787de19d80d110b37fb79ac3985; security practitioners should review these for mitigation guidance and patch information.