Vulnerability: A cross-site scripting (XSS) vulnerability in app/voicemail_greetings/voicemail_greeting_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the id and/or voicemail_id parameter.
Vulnerability ID: CVE-2019-19386
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-11-29
File: app/voicemail_greetings/voicemail_greeting_edit.php
Commit message: Update voicemail_greeting_edit.php
Commit author: FusionPBX

Vulnerable version (before fix):
  	The Initial Developer of the Original Code is 	Mark J Crane <markjcrane@fusionpbx.com> 	Portions created by the Initial Developer are Copyright (C) 2008-2018 	the Initial Developer. All Rights Reserved.  	Contributor(s): 	$language = new text; 	$text = $language->get();  //get greeting id 	if (is_uuid($_REQUEST["id"])) { 		$voicemail_greeting_uuid = $_REQUEST["id"]; 	}  //get the form value and set to php variables 	$voicemail_id = $_REQUEST["voicemail_id"]; 	if (count($_POST) > 0) { 		$greeting_name = $_POST["greeting_name"]; 		$greeting_description = $_POST["greeting_description"]; 	}  if (count($_POST) > 0 && strlen($_POST["persistformvar"]) == 0) { 	//get greeting uuid to edit 		$voicemail_greeting_uuid = $_POST["voicemail_greeting_uuid"];  	//validate the token 		$token = new token;  //pre-populate the form 	if (count($_GET) > 0 && $_POST["persistformvar"] != "true") { 		$voicemail_greeting_uuid = $_GET["id"]; 		$sql = "select * from v_voicemail_greetings "; 		$sql .= "where domain_uuid = :domain_uuid "; 		$sql .= "and voicemail_greeting_uuid = :voicemail_greeting_uuid "; 	echo "<table cellpadding='0' cellspacing='0' border='0' align='right'>\n"; 	echo "<tr>\n"; 	echo "<td nowrap='nowrap'>\n"; 	echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='voicemail_greetings.php?id=".$voicemail_id."'\" value='".$text['button-back']."'>"; 	echo "	<input type='submit' name='submit' class='btn' value='".$text['button-save']."'>\n"; 	echo "</td>\n"; 	echo "</tr>\n"; //include the footer 	require_once "resources/footer.php";  ?>\ No newline at end of file

Fixed version (after fix):
  	The Initial Developer of the Original Code is 	Mark J Crane <markjcrane@fusionpbx.com> 	Portions created by the Initial Developer are Copyright (C) 2008-2019 	the Initial Developer. All Rights Reserved.  	Contributor(s): 	$language = new text; 	$text = $language->get();  //validate the uuids 	if (is_uuid($_REQUEST["id"])) { 		$voicemail_greeting_uuid = $_REQUEST["id"]; 	} 	if (is_uuid($_REQUEST["voicemail_id"])) { 		$voicemail_id = $_REQUEST["voicemail_id"]; 	}  //get the form value and set to php variables 	if (count($_POST) > 0) { 		$greeting_name = $_POST["greeting_name"]; 		$greeting_description = $_POST["greeting_description"]; 	}  if (count($_POST) > 0 && strlen($_POST["persistformvar"]) == 0) {  	//validate the token 		$token = new token;  //pre-populate the form 	if (count($_GET) > 0 && $_POST["persistformvar"] != "true") { 		$sql = "select * from v_voicemail_greetings "; 		$sql .= "where domain_uuid = :domain_uuid "; 		$sql .= "and voicemail_greeting_uuid = :voicemail_greeting_uuid "; 	echo "<table cellpadding='0' cellspacing='0' border='0' align='right'>\n"; 	echo "<tr>\n"; 	echo "<td nowrap='nowrap'>\n"; 	echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='voicemail_greetings.php?id=".urlencode($voicemail_id)."'\" value='".$text['button-back']."'>"; 	echo "	<input type='submit' name='submit' class='btn' value='".$text['button-save']."'>\n"; 	echo "</td>\n"; 	echo "</tr>\n"; //include the footer 	require_once "resources/footer.php"; \ No newline at end of file ?>

Patch:
patch: @@ -17,7 +17,7 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2008-2018
+	Portions created by the Initial Developer are Copyright (C) 2008-2019
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
@@ -42,13 +42,15 @@
 	$language = new text;
 	$text = $language->get();
 
-//get greeting id
+//validate the uuids
 	if (is_uuid($_REQUEST["id"])) {
 		$voicemail_greeting_uuid = $_REQUEST["id"];
 	}
+	if (is_uuid($_REQUEST["voicemail_id"])) {
+		$voicemail_id = $_REQUEST["voicemail_id"];
+	}
 
 //get the form value and set to php variables
-	$voicemail_id = $_REQUEST["voicemail_id"];
 	if (count($_POST) > 0) {
 		$greeting_name = $_POST["greeting_name"];
 		$greeting_description = $_POST["greeting_description"];
@@ -58,8 +60,6 @@
 	}
 
 if (count($_POST) > 0 && strlen($_POST["persistformvar"]) == 0) {
-	//get greeting uuid to edit
-		$voicemail_greeting_uuid = $_POST["voicemail_greeting_uuid"];
 
 	//validate the token
 		$token = new token;
@@ -107,7 +107,6 @@
 
 //pre-populate the form
 	if (count($_GET) > 0 && $_POST["persistformvar"] != "true") {
-		$voicemail_greeting_uuid = $_GET["id"];
 		$sql = "select * from v_voicemail_greetings ";
 		$sql .= "where domain_uuid = :domain_uuid ";
 		$sql .= "and voicemail_greeting_uuid = :voicemail_greeting_uuid ";
@@ -136,7 +135,7 @@
 	echo "<table cellpadding='0' cellspacing='0' border='0' align='right'>\n";
 	echo "<tr>\n";
 	echo "<td nowrap='nowrap'>\n";
-	echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='voicemail_greetings.php?id=".$voicemail_id."'\" value='".$text['button-back']."'>";
+	echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='voicemail_greetings.php?id=".urlencode($voicemail_id)."'\" value='".$text['button-back']."'>";
 	echo "	<input type='submit' name='submit' class='btn' value='".$text['button-save']."'>\n";
 	echo "</td>\n";
 	echo "</tr>\n";
@@ -184,4 +183,4 @@
 //include the footer
 	require_once "resources/footer.php";
 
-?>
\ No newline at end of file
+?>
path: app/voicemail_greetings/voicemail_greeting_edit.php