Vulnerability: In FusionPBX up to v4.5.7, the file app\conferences_active\conference_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS.
Vulnerability ID: CVE-2019-16989
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-21
File: app/conferences_active/conference_interactive.php
Commit message: Update conference_interactive.php
Commit author: FusionPBX

Vulnerable version (before fix):
  	The Initial Developer of the Original Code is 	Mark J Crane <markjcrane@fusionpbx.com> 	Portions created by the Initial Developer are Copyright (C) 2008-2012 	the Initial Developer. All Rights Reserved.  	Contributor(s): 	Mark J Crane <markjcrane@fusionpbx.com> 	James Rose <james.o.rose@gmail.com> */ include "root.php"; require_once "resources/require.php"; require_once "resources/check_auth.php"; if (permission_exists('conference_interactive_view')) { 	//access granted } else { 	echo "access denied"; 	exit; }  //add multi-lingual support 	$language = new text; function loadXmlHttp(url, id) { }  var requestTime = function() { 	var url = 'conference_interactive_inc.php?c=<?php echo trim($_REQUEST["c"]); ?>'; 	new loadXmlHttp(url, 'ajax_reponse'); 	setInterval(function(){new loadXmlHttp(url, 'ajax_reponse');}, 1222); } function send_cmd(url) {  //show the header 	require_once "resources/footer.php"; ?>\ No newline at end of file

Fixed version (after fix):
  	The Initial Developer of the Original Code is 	Mark J Crane <markjcrane@fusionpbx.com> 	Portions created by the Initial Developer are Copyright (C) 2008-2019 	the Initial Developer. All Rights Reserved.  	Contributor(s): 	Mark J Crane <markjcrane@fusionpbx.com> 	James Rose <james.o.rose@gmail.com> */  //includes 	include "root.php"; 	require_once "resources/require.php"; 	require_once "resources/check_auth.php";  //check permissions 	if (permission_exists('conference_interactive_view')) { 		//access granted 	} 	else { 		echo "access denied"; 		exit; 	}  //add multi-lingual support 	$language = new text; function loadXmlHttp(url, id) { }  var requestTime = function() { 	var url = 'conference_interactive_inc.php?c=<?php echo trim(escape($_REQUEST["c"])); ?>'; 	new loadXmlHttp(url, 'ajax_reponse'); 	setInterval(function(){new loadXmlHttp(url, 'ajax_reponse');}, 1222); } function send_cmd(url) {  //show the header 	require_once "resources/footer.php";\ No newline at end of file ?>

Patch:
patch: @@ -17,23 +17,27 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2008-2012
+	Portions created by the Initial Developer are Copyright (C) 2008-2019
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
 	Mark J Crane <markjcrane@fusionpbx.com>
 	James Rose <james.o.rose@gmail.com>
 */
-include "root.php";
-require_once "resources/require.php";
-require_once "resources/check_auth.php";
-if (permission_exists('conference_interactive_view')) {
-	//access granted
-}
-else {
-	echo "access denied";
-	exit;
-}
+
+//includes
+	include "root.php";
+	require_once "resources/require.php";
+	require_once "resources/check_auth.php";
+
+//check permissions
+	if (permission_exists('conference_interactive_view')) {
+		//access granted
+	}
+	else {
+		echo "access denied";
+		exit;
+	}
 
 //add multi-lingual support
 	$language = new text;
@@ -83,7 +87,7 @@ function loadXmlHttp(url, id) {
 }
 
 var requestTime = function() {
-	var url = 'conference_interactive_inc.php?c=<?php echo trim($_REQUEST["c"]); ?>';
+	var url = 'conference_interactive_inc.php?c=<?php echo trim(escape($_REQUEST["c"])); ?>';
 	new loadXmlHttp(url, 'ajax_reponse');
 	setInterval(function(){new loadXmlHttp(url, 'ajax_reponse');}, 1222);
 }
@@ -129,4 +133,4 @@ function send_cmd(url) {
 
 //show the header
 	require_once "resources/footer.php";
-?>
\ No newline at end of file
+?>
path: app/conferences_active/conference_interactive.php