An authenticated user can upload arbitrary files through the image manager component of PhreeBooks ERP 5.2.3. The flaw allows malicious PHP scripts to be stored via the imgFile parameter and subsequently executed by the bizunoFS.php handler, enabling attackers to run arbitrary code on the server. This corresponds to CWE‑434 and directly compromises confidentiality, integrity, and availability of the affected system.

Phreesoft PhreeBooks ERP version 5.2.3 is affected. The vulnerability resides in the image upload endpoint (bizuno/image/manager) of this product.

The CVSS base score of 8.7 indicates high severity, while the EPSS score below 1 % suggests low current exploitation activity. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires valid user credentials, so the attack vector is internal with authenticated users. Once triggered, the flaw can give an attacker full remote code execution capabilities on the host running the application.