CVE-2019-19385
Description
A cross-site scripting (XSS) vulnerability in app/dialplans/dialplans.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the app_uuid parameter.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
FusionPBX 4.4.1 and 4.5.10 have a reflected XSS in dialplans.php via the app_uuid parameter.
Vulnerability
A reflected cross-site scripting (XSS) vulnerability exists in file app/dialplans/dialplans.php in FusionPBX versions 4.4.1 and 4.5.10. The app_uuid parameter is echoed into the page without proper sanitization, allowing injection of arbitrary HTML and JavaScript.[1]
Exploitation
An unauthenticated remote attacker can craft a malicious URL containing a payload in the app_uuid parameter, e.g., https://domain/app/dialplans/dialplans.php?app_uuid=123%27%22%3E%3Csvg/onload=alert(document.domain)%3E%3Ca. When a victim visits this URL, the injected script executes in their browser context.[1]
Impact
Successful exploitation leads to arbitrary JavaScript execution in the victim's browser, potentially enabling theft of session cookies, defacement, or redirection to malicious sites. The attack requires no prior authentication or user interaction beyond visiting the crafted link.[1]
Mitigation
The fix was applied in commit fe504b83db80ebae30c982770f0f0b200b88cbe9 [2], which validates app_uuid using is_uuid() before use. Users should upgrade to a version containing this patch (e.g., after 4.5.10) or apply the commit manually. No workaround is available if the patch cannot be applied.[2]
AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- FusionPBX/FusionPBXdescription
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Missing input validation on the `app_uuid` parameter allows arbitrary HTML/JavaScript to be reflected in the page output."
Attack vector
An unauthenticated remote attacker crafts a URL pointing to `app/dialplans/dialplans.php` with a malicious `app_uuid` parameter containing JavaScript payloads, such as `app_uuid=123%27%22%3E%3Csvg/onload=alert(document.domain)%3E%3Ca` [ref_id=1]. When a victim visits this link, the unsanitized input is reflected in the HTML response, causing the browser to execute the injected script. No authentication or special privileges are required.
Affected code
The vulnerable file is `app/dialplans/dialplans.php` in FusionPBX 4.4.1 (and 4.5.10 per the advisory). The `app_uuid` parameter is read directly from `$_GET["app_uuid"]` without validation and then echoed into the page, enabling reflected XSS [ref_id=1].
What the fix does
The patch [ref_id=2] wraps all assignments of `$app_uuid` from user input (`$_REQUEST["app_uuid"]`, `$_GET["app_uuid"]`, and `$row['app_uuid']`) inside an `is_uuid()` validation check. If the value is not a valid UUID, `$app_uuid` is not set, preventing the unsanitized string from being reflected in the page. Additionally, the patch removes the conditional `is_uuid()` guard around the `$params[]` concatenation lines, ensuring that when `$app_uuid` is empty the parameter is still appended (as an empty value) rather than conditionally omitted, which avoids logic inconsistencies.
Preconditions
- authNo authentication required; the vulnerable endpoint is publicly accessible
- inputAttacker must trick a victim into clicking a crafted URL
- configThe target must be running FusionPBX 4.4.1 (or 4.5.10 per advisory)
Reproduction
Visit the following URL in a browser that has a session (or no session) on the target FusionPBX instance: `https://target/app/dialplans/dialplans.php?app_uuid=123%27%22%3E%3Csvg/onload=alert(document.domain)%3E%3Ca` [ref_id=1]. The JavaScript `alert(document.domain)` will execute, confirming the XSS.
Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- gist.github.com/xax007/28e7326acfae677be0b351216888e522mitrex_refsource_MISC
- github.com/fusionpbx/fusionpbx/commit/fe504b83db80ebae30c982770f0f0b200b88cbe9mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.