PhreeBooks ERP Arbitrary File Upload Vulnerability in Image Manager Component

An arbitrary file upload vulnerability has been identified in PhreeBooks ERP version 5.2.3, specifically within the Image Manager component. This vulnerability allows authenticated attackers to upload malicious files by sending requests to the image upload endpoint. Exploitation involves uploading PHP files through the 'imgFile' parameter to the 'bizuno/image/manager' endpoint, which can then be executed via the 'bizunoFS.php' script, leading to remote code execution.

Impact

Successful exploitation of this vulnerability allows for remote code execution on the server where PhreeBooks ERP is hosted.

Reproduction

To reproduce this vulnerability, an authenticated user must access the Image Manager component. Once there, PHP files can be uploaded by selecting the 'imgFile' parameter and submitting the form. After the file is uploaded, it can be executed by accessing the 'bizunoFS.php' script with the appropriate parameters to trigger the uploaded file.