Vulnerability: In FusionPBX up to 4.5.7, the file app\destinations\destination_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS.
Vulnerability ID: CVE-2019-16976
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-23
File: app/destinations/destination_imports.php
Commit message: Update destination_imports.php
Commit author: FusionPBX

Vulnerable version (before fix):
 function get_parent($schema,$table_name) { 			echo "<tr>\n"; 			echo "<td align='left' width='30%' nowrap='nowrap'><b>".$text['header-destinations_import']."</b></td>\n"; 			echo "<td width='70%' align='right'>\n"; 			echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='/app/destinations/destinations.php?".$_GET["query_string"]."'\" value='".$text['button-back']."'>\n"; 			echo "</td>\n"; 			echo "</tr>\n"; 			echo "<tr>\n"; function get_parent($schema,$table_name) { 	echo "		".$text['description-destination_import']."\n"; 	echo "	</td>\n"; 	echo "	<td valign='top' width='70%' align='right'>\n"; 	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='/app/destinations/destinations.php?".$_GET["query_string"]."'\" value='".$text['button-back']."'>\n"; 	//echo "		<input name='submit' type='submit' class='btn' id='import' value=\"".$text['button-import']."\">\n"; 	echo "	</td>\n"; 	echo "	</tr>\n";

Fixed version (after fix):
 function get_parent($schema,$table_name) { 			echo "<tr>\n"; 			echo "<td align='left' width='30%' nowrap='nowrap'><b>".$text['header-destinations_import']."</b></td>\n"; 			echo "<td width='70%' align='right'>\n"; 			echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='/app/destinations/destinations.php'\" value='".$text['button-back']."'>\n"; 			echo "</td>\n"; 			echo "</tr>\n"; 			echo "<tr>\n"; function get_parent($schema,$table_name) { 	echo "		".$text['description-destination_import']."\n"; 	echo "	</td>\n"; 	echo "	<td valign='top' width='70%' align='right'>\n"; 	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='/app/destinations/destinations.php'\" value='".$text['button-back']."'>\n"; 	//echo "		<input name='submit' type='submit' class='btn' id='import' value=\"".$text['button-import']."\">\n"; 	echo "	</td>\n"; 	echo "	</tr>\n";

Patch:
patch: @@ -467,7 +467,7 @@ function get_parent($schema,$table_name) {
 			echo "<tr>\n";
 			echo "<td align='left' width='30%' nowrap='nowrap'><b>".$text['header-destinations_import']."</b></td>\n";
 			echo "<td width='70%' align='right'>\n";
-			echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='/app/destinations/destinations.php?".$_GET["query_string"]."'\" value='".$text['button-back']."'>\n";
+			echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='/app/destinations/destinations.php'\" value='".$text['button-back']."'>\n";
 			echo "</td>\n";
 			echo "</tr>\n";
 			echo "<tr>\n";
@@ -937,7 +937,7 @@ function get_parent($schema,$table_name) {
 	echo "		".$text['description-destination_import']."\n";
 	echo "	</td>\n";
 	echo "	<td valign='top' width='70%' align='right'>\n";
-	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='/app/destinations/destinations.php?".$_GET["query_string"]."'\" value='".$text['button-back']."'>\n";
+	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='/app/destinations/destinations.php'\" value='".$text['button-back']."'>\n";
 	//echo "		<input name='submit' type='submit' class='btn' id='import' value=\"".$text['button-import']."\">\n";
 	echo "	</td>\n";
 	echo "	</tr>\n";
path: app/destinations/destination_imports.php