Headline
CVE-2019-16974: FusionPBX XSS 7
In FusionPBX up to 4.5.7, the file app\contacts\contact_times.php uses an unsanitized “id” variable coming from the URL, which is reflected in HTML, leading to XSS.
Skip to content
An attacker targeting an authenticated user can push him to click on a URL of FusionPBX 4.5.7 specially crafted to get javascript code executed in his browser.
In FusionPBX up to v4.5.7, file app\contacts\contact_times.php uses an unsanitized “id” variable coming from the URL which is reflected in HTML leading to XSS.
Bug ID: https://www.fusionpbx.com/app/tickets/ticket_edit.php?id=e4f9dc60-6a4b-4e4f-9abf-975614822d43
Fix: https://github.com/fusionpbx/fusionpbx/commit/bcc75d63aa5b721f699a2b416425943ad7707825
Issue was reported on 10/08/2019 by Pierre Jourdan and fixed on 13/08/2019 on 4.4 and Master branches by Mark J Crane.
CVE published, NVD base score is 6.1 MEDIUM:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16974
https://nvd.nist.gov/vuln/detail/CVE-2019-16974