CVE-2019-16990

Name of the Vulnerable Software and Affected Versions FusionPBX versions up to 4.5.7

Description The issue concerns the use of an unsanitized file variable in the music on hold.php file, which allows the download of any pathname, provided it is base64 encoded, when coming from the URL.

Recommendations For FusionPBX versions up to 4.5.7, consider restricting access to the music on hold.php file until a patch is available, or ensure that the file variable is properly sanitized to prevent unauthorized file downloads.