CVE-2019-13396

This flaw can trick FlightPath into grabbing the wrong files from your server. Think of it like giving a web form a “file name” input—if it’s not properly checked, an attacker may be able to make the system open a file it was never meant to show. Even if the impact is not guaranteed, it can expose secrets and help attackers do further damage.

This matters if you run a site using FlightPath 4.x or 5.0-x. It becomes a practical risk when the vulnerable form-handling request (index.php?q=system-handle-form-submit with the form_include parameter) is reachable from where attackers can send POST requests. The vulnerability is reachable only if your web server exposes that endpoint to potential attackers (for example, over the public internet) and the attacker can reach it.

Treat this as an AMBER issue because a public exploit is available and attackers may test it against vulnerable installs. There’s also rising press attention, which often correlates with more probing and attempted attacks. Even though the available patch information is missing here, you should prioritize getting off FlightPath 4.x/5.0-x as soon as you can.

1. Confirm exposure in your environment

   • Identify your FlightPath version.
   • Confirm whether the endpoint index.php?q=system-handle-form-submit is publicly reachable (or reachable from the internet through any path), since the exploit is described as a POST request to that handler.

2. Check for signs of attempted exploitation

   • Review web/app logs for suspicious requests containing form_include, especially values that look like path traversal (for example, containing “../” or unusual file paths).
   • Look for repeated 4xx/5xx responses around the system form handler and any unusual local file access errors.

3. Upgrade strategy (preferred)

   • The provided findings indicate “no fix/patch information available,” so you’ll need to determine the correct fixed release from FlightPath’s vendor/project advisories or release notes.
   • Upgrade off FlightPath 4.x and 5.0-x to the nearest secure version that explicitly addresses CVE-2019-13396.
   • If multiple branches exist, pick the branch with the active security support status and a known fix for this CVE.

4. Interim mitigation if you can’t upgrade immediately

   • Restrict access to index.php?q=system-handle-form-submit from the public internet using firewall rules or a WAF.
   • If your application allows, limit the endpoint to trusted IPs or internal networks.
   • Add request filtering rules for the form_include parameter (block requests where form_include contains traversal-like patterns).

5. Re-test after remediation

   • After upgrade or mitigation, repeat a controlled test to ensure form_include no longer results in unexpected file inclusion behavior.
   • Continue monitoring logs for form_include-related probing for at least a short window after the change.

6. Timing

   • Because no fixed version is provided in the available patch findings and public exploit code exists, prioritize planning and executing the upgrade/migration work immediately (rather than waiting for symptoms).

Severity is effectively moderate (CVE-2019-13396, CVSS 5.3 shown), with the key weakness being path traversal (CWE-22) that enables Local File Inclusion. The described mechanism is that FlightPath’s form handling accepts a form_include parameter and uses include_once in system_handle_form_submit (modules/system/system.module); insufficient validation allows directory traversal, causing the application to include unintended local files. Exploit availability: a public exploit is available (at least one known public implementation). KEV: not listed in CISA KEV. Patch status: no fix/patch information is available in the provided findings, so the exact fixed version is unknown here. Exploit maturity: at least “weaponized” (public exploit code exists); whether it is widely used in the wild is not confirmed by KEV in the provided findings. EPSS is a prediction only and is not used as the deciding factor here since public exploit availability is confirmed.