high8.8
CVE-2021-47904
PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution.
Impact
PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution. Attackers can upload a malicious PHP web shell by exploiting unrestricted file type uploads to gain command execution on the server.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://gist.github.com/joswr1ght/22f40787de19d80d110b37fb79ac3985
- https://www.exploit-db.com/exploits/46645
- https://www.exploit-db.com/exploits/49524
- https://www.phreesoft.com/
- https://www.vulncheck.com/advisories/phreebooks-remote-code-execution
- https://www.exploit-db.com/exploits/49524