CVE-2022-35153 (PHP, published 2022-08-18T05:15Z)
Description: value: FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/fusionpbx/fusionpbx
Files changed:
app/fax/fax_send.php
Commit message: Security use escapeshellarg

Vulnerable code:
					$command .= 'libreoffice --headless --convert-to pdf --outdir '.$dir_fax_temp.' '.$dir_fax_temp.'/'.$fax_name.'.'.$fax_file_extension;
					$cmd = exec('which gs')." -q -r".$gs_r." -g".$gs_g." -dBATCH -dPDFFitPage -dNOSAFER -dNOPAUSE -dBATCH -sOutputFile=".correct_path($fax_name).".tif -sDEVICE=tiffg4 -Ilib stocht.ps -c \"{ .75 gt { 1 } { 0 } ifelse} settransfer\" -- ".correct_path($fax_name).".pdf -c quit";
		$common_variables .= "fax_queue_uuid='"               . $fax_queue_uuid          . "',";
		$common_variables .= "accountcode='"                  . $fax_accountcode         . "',";
		$common_variables .= "sip_h_X-accountcode='"          . $fax_accountcode         . "',";
		$common_variables .= "domain_uuid="                   . $_SESSION["domain_uuid"] . ",";
		$common_variables .= "domain_name="                   . $_SESSION["domain_name"] . ",";
		$common_variables .= "origination_caller_id_name='"   . $fax_caller_id_name      . "',";
		$common_variables .= "origination_caller_id_number='" . $fax_caller_id_number    . "',";
		$common_variables .= "fax_ident='"                    . $fax_caller_id_number    . "',";
		$common_variables .= "fax_header='"                   . $fax_caller_id_name      . "',";
		$common_variables .= "fax_file='"                     . $fax_file                . "',";
					$fax_variables .= $variable.",";
			$dial_string .= "mailto_address='"     . $mail_to_address   . "',";
			$dial_string .= "mailfrom_address='"   . $mail_from_address . "',";
			$dial_string .= "fax_uri=" . $fax_uri  . ",";

Fixed code:
					$command .= 'libreoffice --headless --convert-to pdf --outdir '.$dir_fax_temp.' '.$dir_fax_temp.'/'.escapeshellarg($fax_name).'.'.escapeshellarg($fax_file_extension);
					$cmd = exec('which gs')." -q -r".$gs_r." -g".$gs_g." -dBATCH -dPDFFitPage -dNOSAFER -dNOPAUSE -dBATCH -sOutputFile=".escapeshellarg($fax_name).".tif -sDEVICE=tiffg4 -Ilib stocht.ps -c \"{ .75 gt { 1 } { 0 } ifelse} settransfer\" -- ".escapeshellarg($fax_name).".pdf -c quit";
		$common_variables .= "fax_queue_uuid='"               . escapeshellarg($fax_queue_uuid)          . "',";
		$common_variables .= "accountcode='"                  . escapeshellarg($fax_accountcode)         . "',";
		$common_variables .= "sip_h_X-accountcode='"          . escapeshellarg($fax_accountcode)         . "',";
		$common_variables .= "domain_uuid="                   . escapeshellarg($_SESSION["domain_uuid"]) . ",";
		$common_variables .= "domain_name="                   . escapeshellarg($_SESSION["domain_name"]) . ",";
		$common_variables .= "origination_caller_id_name='"   . escapeshellarg($fax_caller_id_name)      . "',";
		$common_variables .= "origination_caller_id_number='" . escapeshellarg($fax_caller_id_number)    . "',";
		$common_variables .= "fax_ident='"                    . escapeshellarg($fax_caller_id_number)    . "',";
		$common_variables .= "fax_header='"                   . escapeshellarg($fax_caller_id_name)      . "',";
		$common_variables .= "fax_file='"                     . escapeshellarg($fax_file)               . "',";
					$fax_variables .= escapeshellarg($variable).",";
			$dial_string .= "mailto_address='"     . escapeshellarg($mail_to_address)   . "',";
			$dial_string .= "mailfrom_address='"   . escapeshellarg($mail_from_address) . "',";
			$dial_string .= "fax_uri="             . escapeshellarg($fax_uri)           . ",";