Loading vulnerability…
Arbitrary File Upload RCE in PhreeBooks ERP 5.2.3 Image Manager
PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component. An authenticated attacker can submit a crafted request to the bizuno/image/manager endpoint and supply a malicious file via the imgFile parameter. The application does not adequately restrict uploaded file types, allowing PHP files to be uploaded. The uploaded PHP payload can then be invoked through bizunoFS.php, resulting in remote code execution on the server in the context of the web application.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker to achieve remote code execution on the affected PhreeBooks ERP server. This can enable full compromise of application data and functionality, including reading or modifying sensitive ERP data, executing arbitrary commands with the privileges of the web server process, deploying additional payloads, establishing persistence, and potentially pivoting further within the environment depending on host configuration and privileges.
If you can’t patch tonight, do this now.
Restrict access to the vulnerable functionality to only trusted administrative users and minimize the number of accounts with upload capability. Configure the web server so upload directories do not permit script execution. Apply allowlisting for permitted image formats, inspect uploads for content-type mismatches, and rename uploaded files to non-executable names. Monitor for suspicious requests to bizuno/image/manager and execution attempts via bizunoFS.php, and review the filesystem for unexpected PHP files in upload locations.
Patch, then assume compromise.
Upgrade to a fixed version if one is available from the vendor. If no vendor patch is available, remediate by enforcing strict server-side validation of uploaded content in the Image Manager component, disallowing executable file types such as PHP, validating file extensions and MIME types, storing uploads outside the web root, and preventing uploaded files from being executed by the web server. Review and harden access to bizuno/image/manager and bizunoFS.php, and remove any malicious files that may already have been uploaded.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.