An authenticated attacker can upload malicious PHP files through the image manager endpoint by bypassing the file extension check, then execute those files to run arbitrary system commands and establish a reverse shell. This allows the attacker to fully compromise the server that hosts PhreeBooks ERP.

Phreesoft’s PhreeBooks ERP product, version 5.2.3, is impacted. No other versions are listed; an unaffected version is not indicated in the data.

The vulnerability carries a high CVSS score of 8.7, indicating a serious risk. The EPSS score is below 1 percent, suggesting low observed exploit activity to date. It is not listed in the CISA KEV catalog. Exploitation requires valid user credentials; the attacker must first authenticate to access the image manager. Once logged in, the attacker can upload and execute arbitrary PHP code, gaining remote code execution capabilities.