CVE-2019-16979

CVE-2019-16979 affects FusionPBX up to version 4.5.7. The vulnerability is triggered by an unsanitized URL parameter in the file app\contacts\contact_urls.php , where the id value is reflected in HTML, causing a cross-site scripting (XSS) flaw. Public sources consistently describe the impact as c...

CVE-2019-16979

In FusionPBX up to v4.5.7, the file app\contacts\contacturls.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS...

CVE-2019-16980

In FusionPBX up to v4.5.7, the file app\callbroadcast\callbroadcastedit.php uses an unsanitized "id" variable coming from the URL in an unparameterized SQL query, leading to SQL injection...

CVE-2019-16980

CVE-2019-16980 affects FusionPBX up to v4.5.7. The vulnerable component is the file app\call_broadcast\call_broadcast_edit.php, which uses an unsanitized URL parameter (id) directly in an unparameterized SQL query, enabling SQL injection. The documented impact is SQL injection with the potential ...

CVE-2019-16978

CVE-2019-16978 affects FusionPBX up to v4.5.7, where the file app\devices\device_settings.php reads an unsanitized id from the URL and reflects it twice in HTML, causing XSS. The issue arises from insufficient input sanitization in the device_settings component. Impact is client-side script execu...

CVE-2019-16978

In FusionPBX up to v4.5.7, the file app\devices\devicesettings.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS...

PT-2019-14901 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns an SQL injection flaw. Specifically, the call broadcast edit.php file uses an unsanitized id variable from the URL in an unparameterized SQL query. This allows for potential SQ...

PT-2019-14909 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns the use of an unsanitized eavesdrop dest variable in the content.php file, which is reflected in HTML and leads to a cross-site scripting XSS issue. This allows for potential...

PT-2019-14904 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns an XSS vulnerability in the paging function of the resourcespaging.php file. This function is called by several pages of the interface and uses an unsanitized param variable,...

PT-2019-14902 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns the use of an unsanitized id variable from the URL in the file appconference profilesconference profile params.php. This variable is reflected in HTML on two occasions, leading...

PT-2019-14898 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns the use of an unsanitized id variable in the file appdevicesdevice settings.php, which is reflected in HTML and leads to a cross-site scripting XSS issue. Recommendations: For...

PT-2019-14899 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns the use of an unsanitized id variable in the contact urls.php file, which is reflected in HTML. This leads to a potential XSS issue. Recommendations: For FusionPBX versions pri...

PT-2019-14908 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns the use of an unsanitized query string variable in the contact import.php file, which is reflected in HTML. This leads to a cross-site scripting XSS issue, allowing potential...

PT-2019-14911 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions up to 4.5.7 Description: The issue concerns the use of an unsanitized file variable in the music on hold.php file, which allows the download of any pathname, provided it is base64 encoded, when coming from the URL...

PT-2019-14907 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue in FusionPBX allows unauthorized access to download files due to an unsanitized variable f coming from the URL in the file resourcesdownload.php. This enables an attacker to download an...

PT-2019-14889 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns an XSS problem where an unsanitized variable c from the URL is reflected in HTML. This occurs in the file appfifo listfifo interactive.php. Recommendations: For FusionPBX...

FusionPBX Command Injection Vulnerability

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A command injection vulnerability exists in the resources/cmd.php file in FusionPBX 4.5.7 a...

PT-2019-14910 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns the use of an unsanitized variable c from the URL in the file appconferences activeconference interactive.php, which is reflected in HTML. This leads to a cross-site scripting...

PT-2019-14906 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns the use of an unsanitized rec variable in the xml cdr delete.php file, which allows for the deletion of any system file. This is achieved through a base64 decoded variable comi...

PT-2019-14890 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns an XSS vulnerability where an unsanitized savemsg variable from the URL is reflected in HTML. This occurs in the file appsip statussip status.php. Recommendations: For FusionPB...