Cross site scripting

2019-10-2116:15:00

PRIOn knowledge base

www.prio-n.com

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.1%

JSON

In FusionPBX up to v4.5.7, the file resources\paging.php has a paging function (called by several pages of the interface), which uses an unsanitized “param” variable constructed partially from the URL args and reflected in HTML, leading to XSS.

CPENameOperatorVersion
fusionpbxle4.5.7

CPE	Name	Operator	Version
	fusionpbx	le	4.5.7

References

github.com/fusionpbx/fusionpbx/commit/23581e56e9a4d1685ddf1c7d67137417d654e134

resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-15/