Vulnerability: resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute any commands on the host as www-data.
Vulnerability ID: CVE-2019-16965
CWE: CWE-78
Severity score: 10
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-21
File: resources/cmd.php
Commit message: Delete cmd.php
Commit author: FusionPBX

Vulnerable version (before fix):
 <?php /* 	FusionPBX 	Version: MPL 1.1  	The contents of this file are subject to the Mozilla Public License Version 	1.1 (the "License"); you may not use this file except in compliance with 	the License. You may obtain a copy of the License at 	http://www.mozilla.org/MPL/  	Software distributed under the License is distributed on an "AS IS" basis, 	WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License 	for the specific language governing rights and limitations under the 	License.  	The Original Code is FusionPBX  	The Initial Developer of the Original Code is 	Mark J Crane <markjcrane@fusionpbx.com> 	Portions created by the Initial Developer are Copyright (C) 2008-2012 	the Initial Developer. All Rights Reserved.  	Contributor(s): 	Mark J Crane <markjcrane@fusionpbx.com> */ include "root.php"; require_once "resources/require.php"; require_once "resources/check_auth.php"; if (if_group("admin") || if_group("superadmin")) { 	//access granted } else { 	echo "access denied"; 	exit; }  $cmd = $_GET['cmd']; $rdr = $_GET['rdr'];  $fp = event_socket_create($_SESSION['event_socket_ip_address'], $_SESSION['event_socket_port'], $_SESSION['event_socket_password']); if ($fp) { 	$response = event_socket_request($fp, $cmd); 	fclose($fp); }  if ($rdr == "false") { 	//redirect false 	echo $response; } else { 	header("Location: v_status.php?savemsg=".urlencode($response)); } ?>\ No newline at end of file

Fixed version (after fix):
\ No newline at end of file

Patch:
patch: @@ -1,53 +0,0 @@
-<?php
-/*
-	FusionPBX
-	Version: MPL 1.1
-
-	The contents of this file are subject to the Mozilla Public License Version
-	1.1 (the "License"); you may not use this file except in compliance with
-	the License. You may obtain a copy of the License at
-	http://www.mozilla.org/MPL/
-
-	Software distributed under the License is distributed on an "AS IS" basis,
-	WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-	for the specific language governing rights and limitations under the
-	License.
-
-	The Original Code is FusionPBX
-
-	The Initial Developer of the Original Code is
-	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2008-2012
-	the Initial Developer. All Rights Reserved.
-
-	Contributor(s):
-	Mark J Crane <markjcrane@fusionpbx.com>
-*/
-include "root.php";
-require_once "resources/require.php";
-require_once "resources/check_auth.php";
-if (if_group("admin") || if_group("superadmin")) {
-	//access granted
-}
-else {
-	echo "access denied";
-	exit;
-}
-
-$cmd = $_GET['cmd'];
-$rdr = $_GET['rdr'];
-
-$fp = event_socket_create($_SESSION['event_socket_ip_address'], $_SESSION['event_socket_port'], $_SESSION['event_socket_password']);
-if ($fp) {
-	$response = event_socket_request($fp, $cmd);
-	fclose($fp);
-}
-
-if ($rdr == "false") {
-	//redirect false
-	echo $response;
-}
-else {
-	header("Location: v_status.php?savemsg=".urlencode($response));
-}
-?>
\ No newline at end of file
path: resources/cmd.php