An arbitrary file upload vulnerability in PhreeBooks ERP 5.2.3 allows authenticated attackers to execute malicious code on the server, posing a critical risk to system integrity.

This is an unrestricted file upload vulnerability (CWE-434) located within the Image Manager component. Authenticated attackers can upload arbitrary files, including malicious PHP scripts, via the imgFile parameter to the bizuno/image/manager endpoint, which can subsequently be executed via the bizunoFS.php script.

Successful exploitation of this vulnerability allows an authenticated attacker to gain remote code execution on the underlying server. This could lead to a complete system compromise, including unauthorized access to sensitive financial data, modification of ERP records, or the deployment of persistent backdoors, resulting in severe reputational damage and potential regulatory non-compliance. The CVSS score of 8.8 reflects the high severity of this impact.

Immediate Action: Update to the latest version of PhreeBooks ERP or apply the vendor-provided security patches immediately to resolve the file upload restriction flaw.

Proactive Monitoring: Review web server access logs for requests to the bizuno/image/manager endpoint that include unusual file extensions or suspicious POST requests to the bizunoFS.php script.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads containing non-image extensions or to restrict access to administrative and management endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 46644.

Given the availability of public exploit code and the critical nature of remote code execution, organizations running PhreeBooks ERP 5.2.3 must prioritize patching or isolating the affected system immediately. Ensure that only authorized personnel have access to the application, as the flaw relies on an initial authentication step to trigger the malicious upload.