Vulnerability: In FusionPBX up to v4.5.7, the file app\devices\device_settings.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS.
Vulnerability ID: CVE-2019-16978
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-21
File: app/devices/device_settings.php
Commit message: Update device_settings.php
Commit author: FusionPBX

Vulnerable version (before fix):
   The Initial Developer of the Original Code is  Mark J Crane <markjcrane@fusionpbx.com>  Portions created by the Initial Developer are Copyright (C) 2008-2012  the Initial Developer. All Rights Reserved.   Contributor(s):  Mark J Crane <markjcrane@fusionpbx.com> */ require_once "root.php"; require_once "resources/require.php"; require_once "resources/check_auth.php"; if (permission_exists('device_setting_view')) { 	//access granted } else { 	echo "access denied"; 	exit; }  //add multi-lingual support 	$language = new text; 	$text = $language->get();  require_once "resources/header.php"; require_once "resources/paging.php";  //get variables used to control the order 	$order_by = $_GET["order_by"]; 	$order = $_GET["order"]; 	$device_uuid = $_GET["id"];  //show the content 	echo "<table width='100%' cellpadding='0' cellspacing='0' border='0'>\n"; 				echo th_order_by('device_setting_description', $text['label-description'], $order_by, $order); 				echo "<td align='right' width='42'>\n"; 				if (permission_exists('device_setting_add')) { 					echo "	<a href='device_setting_edit.php?device_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>\n"; 				} 				else { 					echo "	&nbsp;\n";  //include the footer 	require_once "resources/footer.php"; ?>\ No newline at end of file

Fixed version (after fix):
   The Initial Developer of the Original Code is  Mark J Crane <markjcrane@fusionpbx.com>  Portions created by the Initial Developer are Copyright (C) 2008-2019  the Initial Developer. All Rights Reserved.   Contributor(s):  Mark J Crane <markjcrane@fusionpbx.com> */  //includes 	require_once "root.php"; 	require_once "resources/require.php"; 	require_once "resources/check_auth.php";  //check permissions 	if (permission_exists('device_setting_view')) { 		//access granted 	} 	else { 		echo "access denied"; 		exit; 	}  //add multi-lingual support 	$language = new text; 	$text = $language->get();  //additional includes 	require_once "resources/header.php"; 	require_once "resources/paging.php";  //get variables used to control the order 	$order_by = $_GET["order_by"]; 	$order = $_GET["order"];  //get the uuid 	if (is_uuid($_GET['id'])) { 		$device_uuid = $_GET['id']; 	}  //show the content 	echo "<table width='100%' cellpadding='0' cellspacing='0' border='0'>\n"; 				echo th_order_by('device_setting_description', $text['label-description'], $order_by, $order); 				echo "<td align='right' width='42'>\n"; 				if (permission_exists('device_setting_add')) { 					echo "	<a href='device_setting_edit.php?device_uuid=".urlencode($device_uuid)."' alt='".$text['button-add']."'>$v_link_label_add</a>\n"; 				} 				else { 					echo "	&nbsp;\n";  //include the footer 	require_once "resources/footer.php";\ No newline at end of file ?>

Patch:
patch: @@ -17,34 +17,43 @@
 
  The Initial Developer of the Original Code is
  Mark J Crane <markjcrane@fusionpbx.com>
- Portions created by the Initial Developer are Copyright (C) 2008-2012
+ Portions created by the Initial Developer are Copyright (C) 2008-2019
  the Initial Developer. All Rights Reserved.
 
  Contributor(s):
  Mark J Crane <markjcrane@fusionpbx.com>
 */
-require_once "root.php";
-require_once "resources/require.php";
-require_once "resources/check_auth.php";
-if (permission_exists('device_setting_view')) {
-	//access granted
-}
-else {
-	echo "access denied";
-	exit;
-}
+
+//includes
+	require_once "root.php";
+	require_once "resources/require.php";
+	require_once "resources/check_auth.php";
+
+//check permissions
+	if (permission_exists('device_setting_view')) {
+		//access granted
+	}
+	else {
+		echo "access denied";
+		exit;
+	}
 
 //add multi-lingual support
 	$language = new text;
 	$text = $language->get();
 
-require_once "resources/header.php";
-require_once "resources/paging.php";
+//additional includes
+	require_once "resources/header.php";
+	require_once "resources/paging.php";
 
 //get variables used to control the order
 	$order_by = $_GET["order_by"];
 	$order = $_GET["order"];
-	$device_uuid = $_GET["id"];
+
+//get the uuid
+	if (is_uuid($_GET['id'])) {
+		$device_uuid = $_GET['id'];
+	}
 
 //show the content
 	echo "<table width='100%' cellpadding='0' cellspacing='0' border='0'>\n";
@@ -107,7 +116,7 @@
 				echo th_order_by('device_setting_description', $text['label-description'], $order_by, $order);
 				echo "<td align='right' width='42'>\n";
 				if (permission_exists('device_setting_add')) {
-					echo "	<a href='device_setting_edit.php?device_uuid=".$_GET['id']."' alt='".$text['button-add']."'>$v_link_label_add</a>\n";
+					echo "	<a href='device_setting_edit.php?device_uuid=".urlencode($device_uuid)."' alt='".$text['button-add']."'>$v_link_label_add</a>\n";
 				}
 				else {
 					echo "	&nbsp;\n";
@@ -161,4 +170,4 @@
 
 //include the footer
 	require_once "resources/footer.php";
-?>
\ No newline at end of file
+?>
path: app/devices/device_settings.php