Vulnerability: In FusionPBX up to v4.5.7, the file app\conference_profiles\conference_profile_params.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS.
Vulnerability ID: CVE-2019-16981
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-21
File: app/conference_profiles/conference_profile_params.php
Commit message: Update conference_profile_params.php
Commit author: FusionPBX

Vulnerable version (before fix):
 	echo th_order_by('profile_param_description', $text['label-profile_param_description'], $order_by, $order); 	echo "<td class='list_control_icons'>"; 	if (permission_exists('conference_profile_param_add')) { 		echo "<a href='conference_profile_param_edit.php?conference_profile_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>"; 	} 	else { 		echo "&nbsp;\n"; 	echo "		<td width='33.3%' align='center' nowrap='nowrap'>$paging_controls</td>\n"; 	echo "		<td class='list_control_icons'>"; 	if (permission_exists('conference_profile_param_add')) { 		echo 		"<a href='conference_profile_param_edit.php?conference_profile_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>"; 	} 	else { 		echo 		"&nbsp;";

Fixed version (after fix):
 	echo th_order_by('profile_param_description', $text['label-profile_param_description'], $order_by, $order); 	echo "<td class='list_control_icons'>"; 	if (permission_exists('conference_profile_param_add')) { 		echo "<a href='conference_profile_param_edit.php?conference_profile_uuid=".escape($_GET['id'])."' alt='".$text['button-add']."'>$v_link_label_add</a>"; 	} 	else { 		echo "&nbsp;\n"; 	echo "		<td width='33.3%' align='center' nowrap='nowrap'>$paging_controls</td>\n"; 	echo "		<td class='list_control_icons'>"; 	if (permission_exists('conference_profile_param_add')) { 		echo 		"<a href='conference_profile_param_edit.php?conference_profile_uuid=".escape($_GET['id'])."' alt='".$text['button-add']."'>$v_link_label_add</a>"; 	} 	else { 		echo 		"&nbsp;";

Patch:
patch: @@ -73,7 +73,7 @@
 	echo th_order_by('profile_param_description', $text['label-profile_param_description'], $order_by, $order);
 	echo "<td class='list_control_icons'>";
 	if (permission_exists('conference_profile_param_add')) {
-		echo "<a href='conference_profile_param_edit.php?conference_profile_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>";
+		echo "<a href='conference_profile_param_edit.php?conference_profile_uuid=".escape($_GET['id'])."' alt='".$text['button-add']."'>$v_link_label_add</a>";
 	}
 	else {
 		echo "&nbsp;\n";
@@ -113,7 +113,7 @@
 	echo "		<td width='33.3%' align='center' nowrap='nowrap'>$paging_controls</td>\n";
 	echo "		<td class='list_control_icons'>";
 	if (permission_exists('conference_profile_param_add')) {
-		echo 		"<a href='conference_profile_param_edit.php?conference_profile_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>";
+		echo 		"<a href='conference_profile_param_edit.php?conference_profile_uuid=".escape($_GET['id'])."' alt='".$text['button-add']."'>$v_link_label_add</a>";
 	}
 	else {
 		echo 		"&nbsp;";
path: app/conference_profiles/conference_profile_params.php