CVE-2019-25647

CVE-2019-25647 is a high-severity Remote Code Execution (RCE) vulnerability affecting PhreeBooks ERP 5.2.3. Authenticated attackers can exploit a flaw in the image manager to bypass file extension controls, allowing the upload and execution of arbitrary PHP files. With a CVSS score of 8.8, this vulnerability has a network attack vector and low attack complexity, potentially leading to full system compromise through reverse shells and system command execution. While not listed on CISA's KEV catalog and lacking public exploits in common databases like Metasploit or ExploitDB, its critical impact remains significant. Community discussion is minimal, with only one mention identified.