CVE-2021-47904

PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution. Attackers can upload a malicious PHP web shell by exploiting unrestricted file type uploads to gain command execution on the server.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/joswr1ght/22f40787de19d80d110b37fb79ac3985
https://www.exploit-db.com/exploits/46645
https://www.exploit-db.com/exploits/49524
https://www.phreesoft.com/
https://www.vulncheck.com/advisories/phreebooks-remote-code-execution
https://www.exploit-db.com/exploits/49524

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) PhreeBooks 5.2.3 contiene una vulnerabilidad de carga de archivos autenticada en el Gestor de Imágenes que permite la ejecución remota de código. Los atacantes pueden cargar una shell web PHP maliciosa explotando las cargas de tipos de archivo sin restricciones para obtener ejecución de comandos en el servidor.

23 Jan 2026, 22:16

Type	Values Removed	Values Added
References	~~() https://www.exploit-db.com/exploits/49524 -~~	() https://www.exploit-db.com/exploits/49524 -

23 Jan 2026, 17:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-23 17:16

Updated : 2026-06-17 04:18

NVD link : CVE-2021-47904

Mitre link : CVE-2021-47904

CVE.ORG link : CVE-2021-47904

JSON object : View

Products Affected

No product.

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2021-47904", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-47904", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-23T20:55:58.124127Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Phreesoft", "product": "PhreeBooks", "versions": [{"status": "affected", "version": "5.2.3"}]}]}], "published": "2026-01-23T17:16:03.990", "references": [{"url": "https://gist.github.com/joswr1ght/22f40787de19d80d110b37fb79ac3985", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/46645", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/49524", "source": "disclosure@vulncheck.com"}, {"url": "https://www.phreesoft.com/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/phreebooks-remote-code-execution", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/49524", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution. Attackers can upload a malicious PHP web shell by exploiting unrestricted file type uploads to gain command execution on the server."}, {"lang": "es", "value": "PhreeBooks 5.2.3 contiene una vulnerabilidad de carga de archivos autenticada en el Gestor de Im\u00e1genes que permite la ejecuci\u00f3n remota de c\u00f3digo. Los atacantes pueden cargar una shell web PHP maliciosa explotando las cargas de tipos de archivo sin restricciones para obtener ejecuci\u00f3n de comandos en el servidor."}], "lastModified": "2026-06-17T04:18:43.730", "sourceIdentifier": "disclosure@vulncheck.com"}