CVE-2019-16989

Vulnerability

In FusionPBX versions up to v4.5.7, the file app\conferences_active\conference_interactive.php uses an unsanitized c parameter obtained from the URL. The value is directly reflected into HTML without proper escaping, leading to a reflected cross-site scripting (XSS) vulnerability [1][2]. The vulnerable code is located in the JavaScript section where the c parameter is echoed via <?php echo trim($_REQUEST["c"]); ?> [1]. The fix in commit 83123e31 wraps the output with escape() [1].

Exploitation

An attacker needs to trick an authenticated FusionPBX user into clicking a crafted URL that includes a malicious payload in the c parameter [2]. No special network position or authentication is required beyond the target being logged in. The URL can be delivered via phishing, social engineering, or injected into another page. Once clicked, the arbitrary JavaScript executes in the user's browser within the context of the FusionPBX session [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, defacement, or redirection to malicious sites. The impact is limited to the authenticated user's session and the functionality accessible to that user. The CVSS v3.1 base score is 6.1 (Medium) per NVD [2].

Mitigation

The vulnerability was fixed in commit 83123e31 by applying the escape() function to the c parameter before output [1][2]. The fix was merged into the FusionPBX repository by Mark J Crane on the same day the issue was reported (Oct 8, 2019) [2]. Users should update to a version later than v4.5.7, or apply the patch manually. No workarounds are documented; upgrading is the recommended action.