CVE-2019-16973

Vulnerability

In FusionPBX versions up to 4.5.7, the file app/contacts/contact_edit.php uses an unsanitized query_string variable taken directly from the URL. This variable is echoed into HTML without any escaping or filtering, enabling Cross-Site Scripting (XSS). The vulnerable code path is at line 349 where $_GET["query_string"] is embedded in an onclick handler's window.location assignment. [1] describes the bug and the fix commit.

Exploitation

An attacker must craft a URL with a malicious query_string parameter and trick an authenticated FusionPBX user into clicking that link. No special network position or authentication bypass is needed; the target must simply be logged in and follow the crafted URL. The injected JavaScript executes in the victim's browser context, within the FusionPBX application session.

Impact

Successful XSS allows the attacker to execute arbitrary JavaScript in the authenticated user's browser. This can lead to session hijacking, data theft (e.g., contact details), or actions performed on behalf of the victim within the FusionPBX interface. The compromise is at the user level, not the server, but can leverage the user's privileges to access or modify application data.

Mitigation

The fix is commit cc820b2eb12a3b7070afdcb7f977f70a1d49ce49 on the FusionPBX GitHub repository, applied to the 4.4 and master branches on 13 August 2019. The patch removes the unsanitized query_string from the onclick handler, replacing it with a fixed string 'contacts.php'. Users should upgrade to a version containing this fix (post-4.5.7). No workaround is documented; the vulnerability is closed by the patch.