CVE-2019-25630: Phreesoft PhreeBooks ERP RCE Vulnerability

CVE-2019-25630 Overview

CVE-2019-25630 is an arbitrary file upload vulnerability affecting PhreeBooks ERP version 5.2.3. The vulnerability exists in the Image Manager component, which fails to properly validate uploaded file types. Authenticated attackers can exploit this flaw by submitting malicious requests to the image upload endpoint, allowing them to upload and execute PHP files on the target server. This results in remote code execution (RCE) capabilities, enabling attackers to fully compromise the affected system.

Critical Impact

Authenticated attackers can achieve remote code execution by uploading malicious PHP files through the Image Manager component, potentially leading to complete system compromise.

Affected Products

• PhreeSoft PhreeBooks ERP 5.2.3
• PhreeBooks ERP installations using the Image Manager component
• Systems running the vulnerable bizunoFS.php script

Discovery Timeline

• 2026-03-24 - CVE-2019-25630 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2019-25630

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The Image Manager component in PhreeBooks ERP 5.2.3 does not implement adequate file type validation when processing uploads. This architectural flaw enables authenticated users to bypass intended security controls and upload executable files to the web server.

The attack requires authentication to the PhreeBooks ERP application, but once authenticated, even low-privileged users can exploit this vulnerability. The network-accessible nature of the endpoint combined with the low attack complexity makes this a significant threat to exposed installations.

Root Cause

The root cause lies in insufficient server-side validation of uploaded files in the Image Manager component. The application fails to properly verify file extensions and MIME types before accepting uploads through the imgFile parameter. Additionally, the bizunoFS.php script allows direct execution of uploaded PHP files without proper access controls, creating a pathway from upload to code execution.

Attack Vector

The attack is executed over the network by sending specially crafted HTTP requests to the bizuno/image/manager endpoint. An authenticated attacker submits a malicious PHP file through the imgFile parameter, bypassing the insufficient validation checks. Once uploaded, the attacker can trigger execution of the uploaded payload by accessing it through the bizunoFS.php script, resulting in arbitrary code execution with the privileges of the web server process.

The exploitation flow involves:

1. Authenticating to the PhreeBooks ERP application
2. Crafting a POST request to the image upload endpoint containing a PHP webshell or reverse shell payload
3. Submitting the malicious file via the imgFile parameter
4. Accessing the uploaded file through the bizunoFS.php script to trigger execution
5. Gaining remote code execution capabilities on the target server

Detection Methods for CVE-2019-25630

Indicators of Compromise

• Unexpected PHP files appearing in image upload directories
• HTTP POST requests to bizuno/image/manager containing PHP file extensions
• Suspicious access patterns to bizunoFS.php with references to newly uploaded files
• Web server logs showing execution of files in image storage directories

Detection Strategies

• Monitor web server logs for POST requests to /bizuno/image/manager containing .php extensions in file names
• Implement file integrity monitoring on image upload directories to detect unauthorized PHP files
• Deploy web application firewall (WAF) rules to block file uploads with executable extensions
• Review authentication logs for unusual patterns preceding suspicious file uploads

Monitoring Recommendations

• Enable verbose logging for the PhreeBooks ERP application and review regularly
• Configure intrusion detection systems to alert on PHP file uploads to image directories
• Implement real-time monitoring for web shell signatures in uploaded content
• Monitor outbound network connections from the web server for potential reverse shell activity

How to Mitigate CVE-2019-25630

Immediate Actions Required

• Upgrade PhreeBooks ERP to a patched version if available from the vendor
• Restrict access to the Image Manager component to only trusted administrators
• Implement network segmentation to limit exposure of the ERP system
• Review existing uploaded files for suspicious PHP content and remove any webshells

Patch Information

Organizations should check the PhreeSoft Official Site and SourceForge Download Page for updated versions that address this vulnerability. Additional technical details are available in the VulnCheck Advisory on PhreeBooks and Exploit-DB #46644.

Workarounds

• Configure web server rules to deny execution of PHP files in image upload directories
• Implement strict file extension whitelisting at the web server level (allow only .jpg, .png, .gif)
• Add server-side validation to verify MIME types match expected image formats
• Consider placing the application behind a reverse proxy with additional upload filtering

# Apache configuration to disable PHP execution in upload directories
<Directory "/path/to/phreebooks/images">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|php3|php4|php5|phps)$">
        Deny from all
    </FilesMatch>
</Directory>