CVE-2019-16977

Vulnerability

FusionPBX versions up to and including 4.5.7 contain a reflected cross-site scripting (XSS) vulnerability in the file app/extensions/extension_imports.php. The unsanitized query_string variable from the URL is directly echoed into the HTML output, allowing an attacker to inject arbitrary JavaScript. The vulnerable code appears on line 361 of the file, where $_GET["query_string"] is used without sanitization in an onclick attribute [1][2].

Exploitation

An attacker must craft a URL containing a malicious query_string parameter and persuade an authenticated user to click on it. No additional privileges are required beyond the victim being logged into FusionPBX. The injected JavaScript executes in the context of the victim's session on the FusionPBX application [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the authenticated user's browser. This can lead to session hijacking, data theft, or unauthorized actions performed on behalf of the victim. The attack scope is limited to the FusionPBX application and the user's session [1].

Mitigation

The vulnerability was fixed in commit fc8e4e2d278ce6bffff21b04248d469a59eb8cd4 on the 4.4 and master branches on 13 August 2019. The fix removes the use of $_GET["query_string"] from the onclick handler, replacing it with a static URL. Users should update to a version containing this fix or apply the patch manually [1][2].