Vulnerability: In FusionPBX up to v4.5.7, the file app\recordings\recording_play.php uses an unsanitized "filename" variable coming from the URL, which is base64 decoded and reflected in HTML, leading to XSS.
Vulnerability ID: CVE-2019-16984
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-21
File: app/recordings/recording_play.php
Commit message: Update recording_play.php
Commit author: FusionPBX

Vulnerable version (before fix):
  	The Initial Developer of the Original Code is 	Mark J Crane <markjcrane@fusionpbx.com> 	Portions created by the Initial Developer are Copyright (C) 2008-2016 	the Initial Developer. All Rights Reserved.  	Contributor(s): 		echo "access denied"; 		exit; 	} 	 	$filename = $_GET['filename']; 	$type = $_GET['type']; //moh //rec  <table width="100%" border="0" cellpadding="0" cellspacing="0"> 	<tr> 		<td align='center'> 			<b>file: <?php echo $filename ?></b> 		</td> 	</tr> 	<tr> 			} 			else { 				echo "<audio src=\"http://localhost:8000/mod/recordings/recordings.php?a=download&type=".urlencode($type)."&filename=".urlencode($filename)."\" autoplay=\"autoplay\"></audio>"; 				echo "<embed src=\"recordings.php?a=download&type=".urlencode($type)."&filename=".urlencode($filename)."\" autostart=\"true\" width=\"300\" height=\"90\" name=\"sound_".$filename."\" enablejavascript=\"true\">\n"; 			} 		} 		if ($file_ext == "mp3") {

Fixed version (after fix):
  	The Initial Developer of the Original Code is 	Mark J Crane <markjcrane@fusionpbx.com> 	Portions created by the Initial Developer are Copyright (C) 2008-2019 	the Initial Developer. All Rights Reserved.  	Contributor(s): 		echo "access denied"; 		exit; 	}  //get the variables 	$filename = $_GET['filename']; 	$type = $_GET['type']; //moh //rec  <table width="100%" border="0" cellpadding="0" cellspacing="0"> 	<tr> 		<td align='center'> 			<b><?php echo escape($filename) ?></b> 		</td> 	</tr> 	<tr> 			} 			else { 				echo "<audio src=\"http://localhost:8000/mod/recordings/recordings.php?a=download&type=".urlencode($type)."&filename=".urlencode($filename)."\" autoplay=\"autoplay\"></audio>"; 				echo "<embed src=\"recordings.php?a=download&type=".urlencode($type)."&filename=".urlencode($filename)."\" autostart=\"true\" width=\"300\" height=\"90\" name=\"sound_".escape($filename)."\" enablejavascript=\"true\">\n"; 			} 		} 		if ($file_ext == "mp3") {

Patch:
patch: @@ -17,7 +17,7 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2008-2016
+	Portions created by the Initial Developer are Copyright (C) 2008-2019
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
@@ -37,7 +37,8 @@
 		echo "access denied";
 		exit;
 	}
-	
+
+//get the variables
 	$filename = $_GET['filename'];
 	$type = $_GET['type']; //moh //rec
 
@@ -51,7 +52,7 @@
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
 	<tr>
 		<td align='center'>
-			<b>file: <?php echo $filename ?></b>
+			<b><?php echo escape($filename) ?></b>
 		</td>
 	</tr>
 	<tr>
@@ -69,7 +70,7 @@
 			}
 			else {
 				echo "<audio src=\"http://localhost:8000/mod/recordings/recordings.php?a=download&type=".urlencode($type)."&filename=".urlencode($filename)."\" autoplay=\"autoplay\"></audio>";
-				echo "<embed src=\"recordings.php?a=download&type=".urlencode($type)."&filename=".urlencode($filename)."\" autostart=\"true\" width=\"300\" height=\"90\" name=\"sound_".$filename."\" enablejavascript=\"true\">\n";
+				echo "<embed src=\"recordings.php?a=download&type=".urlencode($type)."&filename=".urlencode($filename)."\" autostart=\"true\" width=\"300\" height=\"90\" name=\"sound_".escape($filename)."\" enablejavascript=\"true\">\n";
 			}
 		}
 		if ($file_ext == "mp3") {
path: app/recordings/recording_play.php