Vulnerability: In FusionPBX up to v4.5.7, the file app\contacts\contact_import.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.
Vulnerability ID: CVE-2019-16987
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2019-10-21
File: app/contacts/contact_import.php
Commit message: Update contact_import.php
Commit author: FusionPBX

Vulnerable version (before fix):
 function get_parent($schema,$table_name) { 			echo "<tr>\n"; 			echo "<td align='left' width='30%' nowrap='nowrap'><b>".$text['header-contacts_import']."</b></td>\n"; 			echo "<td width='70%' align='right'>\n"; 			echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='contacts.php?".$_GET["query_string"]."'\" value='".$text['button-back']."'>\n"; 			echo "</td>\n"; 			echo "</tr>\n"; 			echo "<tr>\n"; function get_parent($schema,$table_name) { 	echo "		".$text['description-contacts_import']."\n"; 	echo "	</td>\n"; 	echo "	<td valign='top' width='70%' align='right'>\n"; 	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='contacts.php?".$_GET["query_string"]."'\" value='".$text['button-back']."'>\n"; 	//echo "		<input name='submit' type='submit' class='btn' id='import' value=\"".$text['button-import']."\">\n"; 	echo "	</td>\n"; 	echo "	</tr>\n";

Fixed version (after fix):
 function get_parent($schema,$table_name) { 			echo "<tr>\n"; 			echo "<td align='left' width='30%' nowrap='nowrap'><b>".$text['header-contacts_import']."</b></td>\n"; 			echo "<td width='70%' align='right'>\n"; 			echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='contacts.php'\" value='".$text['button-back']."'>\n"; 			echo "</td>\n"; 			echo "</tr>\n"; 			echo "<tr>\n"; function get_parent($schema,$table_name) { 	echo "		".$text['description-contacts_import']."\n"; 	echo "	</td>\n"; 	echo "	<td valign='top' width='70%' align='right'>\n"; 	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='contacts.php'\" value='".$text['button-back']."'>\n"; 	//echo "		<input name='submit' type='submit' class='btn' id='import' value=\"".$text['button-import']."\">\n"; 	echo "	</td>\n"; 	echo "	</tr>\n";

Patch:
patch: @@ -379,7 +379,7 @@ function get_parent($schema,$table_name) {
 			echo "<tr>\n";
 			echo "<td align='left' width='30%' nowrap='nowrap'><b>".$text['header-contacts_import']."</b></td>\n";
 			echo "<td width='70%' align='right'>\n";
-			echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='contacts.php?".$_GET["query_string"]."'\" value='".$text['button-back']."'>\n";
+			echo "	<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='contacts.php'\" value='".$text['button-back']."'>\n";
 			echo "</td>\n";
 			echo "</tr>\n";
 			echo "<tr>\n";
@@ -433,7 +433,7 @@ function get_parent($schema,$table_name) {
 	echo "		".$text['description-contacts_import']."\n";
 	echo "	</td>\n";
 	echo "	<td valign='top' width='70%' align='right'>\n";
-	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='contacts.php?".$_GET["query_string"]."'\" value='".$text['button-back']."'>\n";
+	echo "		<input type='button' class='btn' name='' alt='".$text['button-back']."' onclick=\"window.location='contacts.php'\" value='".$text['button-back']."'>\n";
 	//echo "		<input name='submit' type='submit' class='btn' id='import' value=\"".$text['button-import']."\">\n";
 	echo "	</td>\n";
 	echo "	</tr>\n";
path: app/contacts/contact_import.php