CWE-79

In FusionPBX up to v4.5.7, the file appaccess_controlsaccess_control_nodes.php uses an unsanitized “id” variable coming from the URL, which is reflected in HTML, leading to XSS.

In FusionPBX up to v4.5.7, the file resourcespaging.php has a paging function (called by several pages of the interface), which uses an unsanitized “param” variable constructed partially from the URL args and reflected in HTML, leading to XSS.

In FusionPBX up to v4.5.7, the file apprecordingsrecording_play.php uses an unsanitized “filename” variable coming from the URL, which is base64 decoded and reflected in HTML, leading to XSS.

In FusionPBX up to v4.5.7, the file appcontactscontact_import.php uses an unsanitized “query_string” variable coming from the URL, which is reflected in HTML, leading to XSS.

In FusionPBX up to v4.5.7, the file appbasic_operator_panelresourcescontent.php uses an unsanitized “eavesdrop_dest” variable coming from the URL, which is reflected on 3 occasions in HTML, leading to XSS.

In FusionPBX up to v4.5.7, the file appconferences_activeconference_interactive.php uses an unsanitized “c” variable coming from the URL, which is reflected in HTML, leading to XSS.