Description
PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution. Attackers can upload a malicious PHP web shell by exploiting unrestricted file type uploads to gain command execution on the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Phreesoft | PhreeBooks | 5.2.3 | — |
References
- ExploitDB-49524 exploit
- Official Vendor Homepage product
- ExploitDB-46645 exploit
- Web Shell Payload Gist product
- VulnCheck Advisory: PhreeBooks 5.2.3 - Remote Code Execution third-party-advisory