Cross site scripting

2019-10-2119:15:00

PRIOn knowledge base

www.prio-n.com

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.9%

JSON

An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\admin\modules\contactmanager\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS. It can be requested via a GET request to /admin/ajax.php?module=contactmanager.

CPENameOperatorVersion
contactmanagereq13.0.0 beta1
contactmanagereq13.0.0 beta2
contactmanagereq13.0.0 beta3
contactmanagereq13.0.0 beta4
contactmanagereq13.0.0 beta5
contactmanagerge13.0.2
contactmanagerlt13.0.45.3
contactmanagereq14.0.1
contactmanagereq14.0.1 alpha1
contactmanagereq14.0.1 alpha2

Name	Operator	Version
contactmanager	eq	13.0.0 beta1
contactmanager	eq	13.0.0 beta2
contactmanager	eq	13.0.0 beta3
contactmanager	eq	13.0.0 beta4
contactmanager	eq	13.0.0 beta5
contactmanager	ge	13.0.2
contactmanager	lt	13.0.45.3
contactmanager	eq	14.0.1
contactmanager	eq	14.0.1 alpha1
contactmanager	eq	14.0.1 alpha2